CWE-278 (不安全的预留继承权限) — Vulnerability Class 4

CWE-278 represents a critical access control weakness where software inherits insecure permissions from a source object, such as an archive file, without explicit user consent or awareness. This vulnerability typically arises during file extraction or system initialization processes, allowing attackers to exploit pre-existing, overly permissive settings to gain unauthorized access to sensitive resources. By leveraging these inherited rights, malicious actors can bypass intended security boundaries, potentially leading to data theft, privilege escalation, or complete system compromise. To mitigate this risk, developers must implement strict permission validation mechanisms that override default settings during object creation or modification. Enforcing the principle of least privilege ensures that new objects receive only the minimal necessary access rights, while explicit user confirmation for permission changes prevents silent inheritance of dangerous configurations, thereby maintaining robust security postures against unauthorized exploitation.