Improper Neutralization of Wildcards or Matching Symbols

When an application uses unsanitized input containing wildcards in commands like file searches or system calls, an attacker can craft input that causes the command to match and process far more files or data than intended. For example, a simple `*.txt` in a file deletion command could be manipulated into `*`, potentially leading to catastrophic data loss. To prevent this, developers must treat all user input as untrusted and explicitly escape or remove wildcard characters before they reach any interpreter that performs pattern matching. Input validation should use allowlists of safe characters, and commands should be constructed using APIs that separate arguments from the command logic, rather than dynamically building strings for shell execution.