Path traversal vulnerability in AdonisJS multipart file handling mechanism. When MultipartFile.move() is used without the second options argument or without explicitly sanitizing the filename, an attacker can supply a crafted filename containing traversal sequences to write files outside the intended upload directory. The vulnerability resides in the MultipartFile.move(location, options) function where if the name parameter is not passed, the application defaults to an unsanitized client filename. This allows path traversal attacks where attackers can choose arbitrary destinations and potentially overwrite sensitive files if overwrite flag is set to true. If application code, startup scripts, or configuration files can be overwritten, remote code execution becomes possible.