				$this->paths[substr($key, strlen('path-'))] = $value;
		}	

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.