It's possible to bypass directory traversal protection by adding few slashes into path.
vulners.com/securityvulns/securityvulns:doc:6152
vulners.com/securityvulns/securityvulns:doc:6611