			$fontfile = self::_getfontpath().$file;
		} elseif (@file_exists($file)) {
			$fontfile = $file;
		}
		return $fontfile;
	}
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.