CVE-2026-35583: Incomplete Path Traversal Denylistcve-2026-35583-incomplete-path-traversal-denylist
Detected an incomplete denylist for preventing path traversal. Validating input using string methods like `contains("..")` or `contains("/")` can be bypassed via URL encoding, double encoding, or Unicode normalization because the decoded literal characters are not matched. Instead, use a strict regular expression allowlist (e.g., `^[a-zA-Z0-9._-]+$`) to vali
