function getData(callback) {
    adapter.log.info('requesting all states');
    let tasks = 0;
    tasks++;
    adapter.getForeignStates('*', (err, res) => {
        adapter.log.info('received all states');
        states = res;
        !--tasks && callback && callback();
    });
    adapter.log.info('requesting all objects');
    tasks++;
    adapter.objects.getObjectList({include_docs: true}, (err, res) => {
        adapter.log.info('received all objects');
        if (res) {
            res = res.rows;
            objects = {};
            let tmpPath = '';
            for (let i = 0; i < res.length; i++) {
                objects[res[i].doc._id] = res[i].doc;
                if (res[i].doc.type === 'instance' && res[i].doc.common && res[i].doc.common.tmpPath) {
                    tmpPath && adapter.log.warn('tmpPath has multiple definitions!!');
                    tmpPath = res[i].doc.common.tmpPath;
                }
            }

            // Some adapters want access on specified tmp directory
            if (tmpPath) {
                adapter.config.tmpPath = tmpPath;
                adapter.config.tmpPathAllow = true;
            }

            createUpdateInfo();
            writeUpdateInfo();
        }

        !--tasks && callback && callback();
    });
}

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.