Serious security errors:

• Using form input in a pathname without sanitizing it; specifically:
• Allowing sneaky examination of the system by user input of paths starting with lots of dotdot entries.

    -- Chip Salzenberg, Free-Floating Agent of Chaos