Path Equivalence: 'filedir*' (Wildcard)

The core issue is that the asterisk wildcard, often used for pattern matching, is interpreted by the underlying operating system during path resolution. When an application passes user-supplied input like 'config*.txt' directly to file system APIs, the OS may resolve it to multiple unexpected files (e.g., 'config.txt', 'config_backup.txt', 'config_old.txt'). This creates an ambiguous path that can lead to unauthorized data exposure, file corruption, or even remote code execution if critical system files are targeted. To prevent this, developers must implement strict input validation that rejects paths containing wildcards before processing. Alternatively, applications should use allowlists of permitted filenames or canonicalize the path and then verify it resides strictly within the intended directory. Never rely on client-side validation alone; all path sanitization must be performed server-side using the application's trusted context.