system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
"""
script that works with parstubuilder to decompress simulation vtk files
for a parametric study (assumes the data has already been compressed).
"""
import tarfile
import datetime as dt
import shutil
import os

# name of the parametric study who's data you wish to decompress
studyDir = '/absolute/path/to/parstubuilder/parametric/study/directory'

# -----------------------------------------------------------------
# get list of simulation directories from parStudyInfo.txt file 
# (generated by parstubuilder)
# -----------------------------------------------------------------

simList = []
with open(studyDir+'/parStudyInfo.txt') as fin:
    for line in fin:
        if 'Unique parameter set' in line:
            break
    for line in fin:
        simList.append(line.rstrip())
fin.close()

# -----------------------------------------------------------------
# use tar to decompress and unpack archive of each simulation's 
# vtk data
# -----------------------------------------------------------------

logName = 'decompressError.log'
print('\n\nBEGINNING DATA DECOMPRESSION FOR PARAMETRIC STUDY STORED IN:\n')
print(studyDir+'\n')
for pth in sorted(simList):

    # name of directory to where archive is stored
    dirName = studyDir+'/'+pth
    # name of archive file with full path
    arName = dirName+'/vtkoutput.tar.gz'
    try:
        with tarfile.open(arName, "r:gz") as tar:
            tar.extractall(dirName)
        print('- successfully decompressed and unpacked: '+arName)
        print()
        # remove the archive
        os.remove(arName)
    except Exception as tarError:
        # log errors
        fullLogName = studyDir+'/'+pth+'/'+logName
        print('\n- An exception was thrown while trying to decompress and unpack the following archive:\n')
        print('\t'+dirName+'\n')
        print('\t* writing error info on '+fullLogName)
        print('\t* removing failed data: '+arName)
        print()
        # write the log file
        with open(fullLogName,"w") as log:
            log.write(str(dt.datetime.now())+'\n')
            log.write('encountered exception of type: '+str(type(tarError))+'\n')
            log.write(str(tarError))

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
  B) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  C) CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
  D) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  E) CWE-943: Improper Neutralization of Special Elements in Data Query Logic
  F) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Answer: F