Path containment is a file-system control that keeps application writes inside an approved directory. When a server handles uploads, exports, cache files, or temporary content, it should verify that every target path stays within the expected folder and cannot escape through tricks like path traversal, symlinks, or unsafe path joins.
This matters because many attacks begin with a write primitive. If an attacker can make a plugin save a file outside the intended upload area, they may place scripts in a web-accessible location or overwrite sensitive files. Strong path containment reduces that risk by rejecting paths that resolve elsewhere and by enforcing canonical, allowlisted directories. In defenses, it is paired with strict file-type checks, least-privilege permissions, and separate storage for untrusted uploads. In incident response, weak path containment is a clue to inspect unexpected files, unusual directory writes, and any content that became executable.