My team have been asked to 'enhance' a web app to permit the following. Is this considered a security risk in a web app? I'm not sure about this.

"Be able to access directories, for exporting and importing [data into the database] , outside of the virtual directory"

In other words the requester wishes to be able to navigate to a data file anywhere outside the application's IIS virtual directory, presumably when importing (or exporting) data. 

I think this means on the web server, but it may mean local files on the client machine (to be clarified). But either way the question stands.