 create_response(const char *nurl, const char *method, unsigned int *rp_code)
 {
       char *page, *fpath;
        struct MHD_Response *resp = NULL;
 
        if (!strncmp(nurl, URL_BASE_API_1_1, strlen(URL_BASE_API_1_1))) {
                resp = create_response_api(nurl, method, rp_code);
        } else {
                fpath = get_path(nurl, server_data.www_dir);
 
               resp = create_response_file(nurl, method, rp_code, fpath);
 
                free(fpath);
        }
}

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.