CWE-28 (路径遍历：’..filedir’) — Vulnerability Class 1

CWE-28 represents a critical input validation weakness where applications fail to properly sanitize external data before constructing file system paths. Attackers typically exploit this vulnerability by injecting directory traversal sequences, such as “..\” or “../”, into user-controlled inputs like filenames or URL parameters. These sequences allow the application to navigate upward in the directory hierarchy, bypassing intended restrictions and accessing sensitive files outside the designated sandbox, such as system configuration files or private user data. To prevent such exploits, developers must implement strict input validation that rejects any path containing traversal characters. Additionally, using canonicalization techniques to resolve the absolute path before checking it against an allowlist of permitted directories ensures that the final location remains within the expected boundaries. Employing secure APIs that abstract direct file system access further mitigates the risk of unintended path resolution.