SECURITY: Directory Traversal #1200
Description
Location of vulnerability: Line 187 in user.py
Severity: High (Similar rating to another similar app/use-case)
Description: The avatar() method of UserAPI() in user.py allows for Directory Traversal and Information Disclosure. The method uses request.save() from Flask, but does NOT validate the filename (variable fname) for harmful characters first.
Remediation: Use pathlib.Path and explicit checks to validate fname before using. More information on potential implementation found here.