It might be because of path normalization by your http client. For example, with `curl` you will also need to use `--path-as-is` to correctly test traversal. An

It might be because of path normalization by your http client. For example, with `curl` you will also need to use `--path-as-is` to correctly test traversal. Another reason could be path normalization by the reverse proxy/WAF. > --path-as-is > Tell curl to not handle sequences of /../ or /./ in the given URL path. Normally curl will squash or merge > them according to standards but with >this option set you tell it not to do that. > Added in 7.42.0.