PHP : Path manipulation

Using data from an untrusted source when working with the file system may give an attacker access to important system files.

By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.