set_interface_reachtime(const char *iface, uint32_t rtime)
{
	int ret;

	if (privsep_enabled())
		return privsep_interface_reachtime(iface, rtime);

	ret = set_interface_var(iface,
				PROC_SYS_IP6_BASEREACHTIME_MS,
				NULL,
				rtime);
	if (ret)
		ret = set_interface_var(iface,
					PROC_SYS_IP6_BASEREACHTIME,
					"BaseReachableTimer",
					rtime / 1000); /* sec */
	return ret;
}

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.