This lesson illustrates the common problem of trusting a user-supplied filename, then using it to generate a file path. Try uploading a file that will execute on the server.