External Control of File Name or Path

Property	Value
Language
Severity
CWE	CWE-73: External Control of File Name or Path
OWASP	A04:2021 - Insecure Design
Confidence Level	Low
Impact Level	Medium
Likelihood Level	Low

Description

The code uses a user-supplied filename directly in the flask.send_file() function without sanitizing the input. This allows attackers to request and access arbitrary files on the server.

Impact

If exploited, an attacker could download sensitive or private files from the server, such as configuration files, credentials, or application source code. This can lead to data breaches, exposure of secrets, and compromise of the application or underlying system.