Constructing a File from request-derived input without validation enables path traversal.
Canonicalize the path and verify it stays within an allowed base directory.