Filesystem canonicalization is the process of turning a path into one exact, normalized form before a program trusts it. A canonical path resolves elements like .., duplicate separators, symbolic links, and relative references so the software can compare the real destination instead of the user-supplied text.
This matters because attackers often hide traversal payloads inside paths that look harmless at first glance. If an application checks a raw string such as org/../hooks without canonicalizing it, the request may escape the intended directory and overwrite sensitive files. In server software, that can lead to data loss, privilege abuse, or code execution through writable locations like hook directories. Defenders use canonicalization together with allowlists, base-directory checks, and path containment tests to ensure the resolved target stays inside the expected tree.