Path traversal
Also called directory traversal, dot dot slash
A filename from a user includes ../, which means "the folder above", until it climbs out of the folder you meant to serve. Then your server hands over files you never meant to expose.
Removing ../ with a replace looks like a fix, and it isn't: ....// becomes ../ once the inner part is stripped. The check has to run on the final resolved path.
Say it to your agent
“Resolve the path with path.resolve after decoding it, and refuse it unless it starts with the uploads folder plus a separator. Add tests for ../../etc/passwd, ....//etc/passwd and ..%2f..%2fetc%2fpasswd. Better still, store files under random ids so a user's filename never touches the disk.”