Given the claims relate to path traversal I assume it’s from (some) software treating http path trailers as FS paths, where a leading / would be an absolute path.