system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import os.path
import shutil
import tarfile
import tempfile

from .base import Command
from ..npm import Client


class Install(Command):
    """Download and install the vendored packages and their dependencies."""

    def add_arguments(self, parser):
        super().add_arguments(parser)
        parser.add_argument('-y', '--yes', action='store_true', default=False,
                            dest='ignore', help="Ignore all prompts.")

    def handle(self, options):
        config = self.get_config(options)
        client = Client(config.metadata_dir, config.registry)

        if not options.ignore:
            print(f'Proceeding may erase files in {config.location_dir}.')
            confirm = input('Are you sure you want to do this? [y/N] ')
            if confirm.lower() in ['', 'n', 'no']:
                return

        # Get pacakge metadata
        for package in config.packages:
            client.get_metadata(package['package'])

        # Download archives and checksum against lockfile
        for package in config.packages:
            archive = client.get_archive(package['package'], package['version'])
            if not client.checksum(archive, package['shasum']):
                package, version = package['package'], package['version']
                raise RuntimeError(f"Checksum failure for {package}@{version}. "
                                   f"Archive and lockfile shasums do not match. ")

        # Clear existing directories in install location and untar the archives
        os.makedirs(config.location_dir, exist_ok=True)
        for package in config.packages:
            archive = client.get_archive(package['package'], package['version'])
            install = os.path.join(config.location_dir, package['package'])

            with tempfile.TemporaryDirectory() as unpack:
                with tarfile.open(archive, 'r:gz') as tar:
                    tar.extractall(unpack)

                if os.path.exists(install):
                    shutil.rmtree(install)
                shutil.move(os.path.join(unpack, 'package'), install)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
  B) CWE-20: Improper Input Validation
  C) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  D) CWE-326: Inadequate Encryption Strength
  E) CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
  F) CWE-116: Improper Encoding or Escaping of Output
Answer: C