Objective Read a file that lives OUTSIDE the student documents folder.
💡 Show hint
The file parameter is joined onto a folder path. Climb out with ../ — e.g. file=../../tmp/secret/secret.txt, or file=../../etc/passwd.
FlawThe filename is used without sanitisation (path traversal).FixResolve the real path and confirm it stays inside the allowed folder; use os.path.basename + an allow-list.