CWE-39 (路径遍历：’C:dirname’) — Vulnerability Class 1

CWE-39 represents a path traversal vulnerability specifically involving Windows drive letters, allowing attackers to redirect file access to unintended locations. This weakness occurs when software fails to properly sanitize input containing drive designators like 'C:dirname', enabling malicious users to bypass intended directory restrictions and access arbitrary files or system resources. Exploitation typically involves injecting these drive letters into user-controlled parameters, such as file paths or URLs, to traverse outside the expected application directory. To mitigate this risk, developers must implement strict input validation that rejects or escapes drive letters and special characters. Additionally, using canonicalization techniques to resolve paths before access checks and enforcing strict allow-lists for permitted directories ensures that user input cannot manipulate the file system structure, thereby preventing unauthorized data exposure or system compromise.