CWE-37 (路径遍历：’/absolute/pathname/here’) — Vulnerability Class 6

CWE-37 represents a critical input validation weakness where applications accept absolute pathnames without sufficient scrutiny, enabling attackers to manipulate file system navigation. This vulnerability is typically exploited by injecting directory traversal sequences, such as "../" or absolute paths, into user-controlled inputs like filenames or URL parameters. By doing so, malicious actors can bypass intended access controls to read sensitive configuration files, exfiltrate private data, or execute arbitrary code from unintended locations within the server’s file hierarchy. To mitigate this risk, developers must implement strict input validation that rejects any absolute paths or traversal characters, ensuring only relative paths within a designated, safe directory are processed. Additionally, using canonicalization techniques to resolve and verify paths before access, combined with least-privilege file system permissions, significantly reduces the attack surface and prevents unauthorized file system traversal.