Comment by Armin Ronacher on How can I securely pass an arbitrarily deep path to a webapp (Flask, in this case)?

That's your browser resolving the path. By itself the path converter does not sanitize the path. See my answer below for the proper solution for that problem.