Websites that are vulnerable to directory traversal or path traversal can allow personal files to be leaked to attackers.
If this vulnerability is exist on the page after login, the attacker will need to get an account, which reduces the risk of being detected by random attacks by tools.

Suppose you have a function that allows the web server to retrieve the file name from the browser and return the specified file to the browser or display information.
An attacker may be able to gain access to private files by altering the file names that are passed to the server.
The files that can be accessed are limited by the permissions of the web server, but if a critical file can be accessed, it will be a serious incident.

The following file names are a list of common file names that may be retrieved.

As a countermeasure, properly check the characters in the file names retrieved from the browser to ensure that ../ or ..\.