Daily security quiz #2

Question for 2026-11-02. Read the code and pick the most serious security vulnerability.

This Express route serves uploaded files for download. What is the most serious vulnerability?

1const path = require('path');
2 
3app.get('/download', (req, res) => {
4  const file = req.query.name;
5  const target = path.join(__dirname, 'uploads', file);
6  res.sendFile(target);
7});

1. AFiles may become corrupted because Content-Type is not specified
2. BIncluding ../ in the file name allows files outside uploads to be read (path traversal)
3. CsendFile is synchronous, so it blocks the server
4. DThe lack of a login check allows CSRF attacks