Building a file path from params in File.read, File.open, or send_file enables path traversal.
Resolve the path and confirm it stays within an allowed base directory before access.