CWE-35 (路径遍历：’…/…//’) — Vulnerability Class 149

CWE-35 represents a critical path traversal vulnerability where software fails to properly sanitize input containing the specific sequence ‘.../...//’. This weakness allows attackers to bypass directory restrictions by exploiting how certain operating systems or application frameworks resolve these unusual path segments. By injecting this sequence into user-controlled input, an adversary can manipulate file system navigation to access sensitive files located outside the intended restricted directory, potentially leading to unauthorized data disclosure or system compromise. Developers mitigate this risk by implementing rigorous input validation that strictly rejects or neutralizes all path traversal characters, including this specific triple-dot variant. Additionally, using canonicalization functions to resolve paths before comparison and enforcing strict allow-lists for permitted file extensions ensures that external input cannot redirect execution to unintended system locations.