Non-authenticated path traversal leading to arbitrary file read