Constructing a File or FileInputStream from request-derived input allows path traversal outside the intended directory.
Canonicalize the path and verify it stays within an allowed base directory before opening.