Internal machine learning API endpoint for CWE classification is vulnerable to path traversal