Imagine an app that loads templates using a URL like: https://example.com

: Likely a parameter or prefix used by the target application (e.g., a static site generator or a reporting tool) to fetch a specific template file.

: Never run web servers as the root user. If the server runs as a low-privileged user (e.g., www-data ), it won't have permission to read files in the /root/ directory even if a traversal vulnerability exists.