CWE-41 (对路径等价的解析不恰当) — Vulnerability Class 23

CWE-41 represents a critical input validation weakness where applications fail to properly normalize file paths before processing them. This vulnerability arises when software does not adequately resolve special characters, such as symbolic links or relative path sequences, which can map to multiple distinct representations of the same file system object. Attackers typically exploit this by injecting these ambiguous characters into user-supplied inputs, effectively bypassing access controls that rely on incomplete path matching logic. By manipulating the path representation, an adversary can access restricted files or directories that were ostensibly protected by the application’s security mechanisms. To mitigate this risk, developers must implement robust path normalization routines that resolve all symbolic links and relative references before performing any security checks. Additionally, using absolute paths and strict allow-lists for permitted directories ensures that the application interacts only with intended resources, thereby closing the gap that path equivalence attacks seek to exploit.