Hacker News Reader

Based on a quick read of the source, the conversion from a "<param..>" input to a "PathBuf" type strips leading ".." components automatically.

So would this still work?

  ValidDir/../../../../../../../etc/passwd