```json
[
  {
    "severity": "High",
    "issue": "Path traversal vulnerability via unsanitized 'path' parameter",
    "exploit": "An attacker can craft a request such as `/download?path=../../../../etc/passwd&token=ADMIN_TOKEN` or use symlinks inside `/srv/reports` to read arbitrary files on the server.",
    "fix": "Validate and sanitize the `path` value. Resolve it to an absolute path (e.g., using `os.path.realpath`) and ensure it remains within the intended directory (`/srv/reports`). Reject any path that resolves outside this directory or use a safe join function that prevents traversal."
  }
]
```