system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import flask
import requests
from jinja2 import Template
from flask import request, send_from_directory
from flask_caching import Cache
import mirador_settings
from flask_cors import CORS
import sys
import logging


def cache_key():
    return request.url


app = flask.Flask(__name__, static_folder="build")
CORS(app)
cache = Cache(app, config={"CACHE_TYPE": "filesystem", "CACHE_DIR": "./cache/"})


@app.route("/<path:filename>")
def send_file(filename):
    return send_from_directory(app.static_folder, filename)


@app.route("/mirador", methods=["GET"])
@cache.cached(timeout=int(mirador_settings.cache_timeout), key_prefix=cache_key)
def mirador():
    """
    Flask app.

    Renders a simple Jinja template with Mirador populated with the right manifest and canvas URIs.
    
    """
    with open("index.html", "r") as local_template:
        mirador_template = local_template.read()
    if mirador_template:
        t = Template(mirador_template)
        if flask.request.method == "GET":
            manifest = request.args.get("manifest", default=None, type=str)
            canvas = request.args.get("canvas", default=None, type=str)
            if manifest:
                manifest_json = None
                m = requests.get(manifest)
                if m.status_code == requests.codes.ok:
                    manifest_json = m.json()
                else:
                    logging.error("The manifest request returned %s", m.status_code)
                    flask.abort(m.status_code)
                if not canvas:
                    if manifest_json:
                        try:
                            logging.debug("Using first canvas by default.")
                            canvas = manifest_json["sequences"][0]["canvases"][0]["@id"]
                        except KeyError:
                            logging.error("Could not identify first canvas in manifest")
                            flask.abort(500)
                    else:
                        logging.error("No manifest available.")
                        flask.abort(404)
            template_result = t.render(manifest_uri=manifest, canvas_uri=canvas)
            return flask.Response(template_result)
        else:
            logging.error("Unsupported HTTP method.")
            flask.abort(405)
    else:
        logging.error("Could not find JINJA2 template.")
        flask.abort(500)


if __name__ == "__main__":
    logging.basicConfig(
        stream=sys.stdout,
        level=logging.DEBUG,
        format="%(asctime)s,%(msecs)d %(name)s %(levelname)s %(message)s",
    )
    app.run(threaded=True, debug=True, port=5000, host="0.0.0.0")

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  B) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  C) CWE-918: Server-Side Request Forgery (SSRF)
  D) CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
  E) CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
  F) CWE-215: Insertion of Sensitive Information Into Debugging Code
Answer: B,C,F