Express: Can the * be exploited?

So I’m making an app where the file you access is based off of your url using:app.get(‘/users/*’, (req, res) => { res.send(fs.readFileSync(__dirname + “/users/person/anotherfile/“ + req.url); });Obviously it’s not my real code, but the idea is the part after users will be the path to a file. If I put a ‘..’ in can you do anything with it, besides read data?My plan was to send a 403 if it contained a ‘..’ would this work? What other ways can the * be exploited?

Submitted August 28, 2019 at 08:54PM by Creeperofhope