use more precise term for I/O injection: Directory traversal attack