                    $files[$i] = '.' . DIRECTORY_SEPARATOR . basename($file);
                }
                $files = array_map('escapeshellarg', $files);

                $cmd = $arc['cmd'] . ' ' . $arc['argc'] . ' ' . escapeshellarg($name) . ' ' . implode(' ', $files);
                $err_out = '';
                $this->procExec($cmd, $o, $c, $err_out, $dir);
                chdir($cwd);
            } else {
                return false;
            }
        }
        $path = $dir . DIRECTORY_SEPARATOR . $name;
        return file_exists($path) ? $path : false;
    }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.