File read function receives request data directly, allowing path traversal to arbitrary files.
Canonicalize with realpath() and confirm the path stays within an allowed base directory.