Path Traversal lets attackers escape the web root using ../ sequences in file parameters.
Example: GET /download?file=../../etc/shadow.
Mitigation
Canonicalise paths (realpath()), assert the resolved path starts with the allowed base directory.