Language: JavaScript
Label: vulnerable
CWE: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Code:
	async function doExport(socket, data, type) {
		sockets.warnDeprecated(socket, 'POST /api/v3/users/:uid/exports/:type');

		if (!socket.uid) {
			throw new Error('[[error:invalid-uid]]');
		}

		if (!data || parseInt(data.uid, 10) <= 0) {
			throw new Error('[[error:invalid-data]]');
		}

		await user.isAdminOrSelf(socket.uid, data.uid);

		api.users.generateExport(socket, { type, ...data });
	}