(CWE-22) violates the second VALIDITY property in lines 2, 4, and 6. Path traversal is
possible because an input of "../abc" for ftype would generate the filename "/home
/cwe/../abc.dat" which is EQUIVALENT to "home/abc.dat". As a result of the path
traversal, the targeted file is ACCESSIBLE even when the intended policy states that it