A county download endpoint accepts a file path parameter and returns document contents with little sanitization. What vulnerability class should the tester prioritize investigating?
Select an answer to reveal the explanation.
Short Explanation
If the app lets you name the file it opens, you might talk it into opening the wrong drawer. Path traversal and LFI are that wrong-drawer problem — unsanitized path params can spill config and secrets. You are classifying the risk, not dumping a scavenger hunt of filenames.
Full Explanation
Endpoints that take filesystem paths or include parameters without canonicalization and allowlisting are classic LFI and directory traversal targets. Successful abuse can disclose application source, credentials, or other sensitive files depending on OS permissions. Assessment focuses on proving the class and impact within rules of engagement, not publishing exhaustive file lists. Unrelated issues such as open redirect or VPN spraying do not address this parameter pattern.