 function scan($dir, $filter = '') {
    $path = FM_ROOT_PATH.'/'.$dir;
    $ite = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($path));
    $rii = new RegexIterator($ite, "/(".$filter.")/i");

    $files = array(); 
    foreach ($rii as $file) {
        if (!$file->isDir()) {
            $fileName = $file->getFilename();
            $location = str_replace(FM_ROOT_PATH, '', $file->getPath());
            $files[] = array(
                    "name" => $fileName,
                    "type" => "file",
                    "path" => $location,
                );           
        }
    }
    return $files;
}
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.