That's one possibility. Another common flaw is upload/download features, where you can get directory traversal (../) in the upload or download file name that yo

That's one possibility. Another common flaw is upload/download features, where you can get directory traversal (../) in the upload or download file name that you are specifying. When you've got file read, procfs is very nice :)