Language: JavaScript
Label: vulnerable
CWE: CWE-1188 \u2014 Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Code:
    handler: function (req, reply) {
      const file = req.params['*']
      reply.sendFile(file)
    }