CWE-38
Path Traversal: 'absolutepathnamehere'
The product accepts input in the form of a backslash absolute path ('absolutepathnamehere') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Impactr finds and proves whether CWE-38 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.