Permission model bypass by specifying a path traversal sequence in a buffer,

Node.js disclosed a bug submitted by haxatron1: https://hackerone.com/reports/2038134