Opening files with user-controlled paths allows directory traversal.
Validate file paths using os.path.realpath() and check against an allowed base directory.