CWE-27 (路径遍历：’dir/../../filename’) — Vulnerability Class 20

CWE-27 represents a critical input validation weakness where software fails to properly sanitize external inputs used to construct file paths. Attackers typically exploit this vulnerability by injecting sequences like “../” into user-supplied parameters, tricking the application into resolving references outside the intended restricted directory. This allows unauthorized access to sensitive system files, configuration data, or other resources that should remain hidden. To mitigate this risk, developers must implement robust input validation techniques, such as strict allow-listing of permitted characters and rejecting any path components containing traversal sequences. Additionally, using canonicalization functions to normalize paths before validation ensures that obfuscated attempts are detected. Restricting file system access through chroot jails or containerization further limits the blast radius, ensuring that even if traversal occurs, the attacker cannot escape the designated secure boundary.