Node.js · File System · Junior · Scenario
What path traversal risks exist with user-provided filenames?
Short Interview Answer
Users can pass `../` to escape intended directories if you naively join paths.
Detailed Explanation
Resolve and ensure the final path stays under an allowlisted root. Prefer generated IDs over raw names. Never trust Content-Disposition filenames blindly.