    def __init__(self, pidfile=None):
        if not pidfile:
            # PID file moved out of /tmp to avoid security vulnerability
            # changed by Debian maintainer per Debian bug #631912
            self.pidfile = "/var/run/pyro-%s.pid" % self.__class__.__name__.lower()
        else:
            self.pidfile = pidfile
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.