An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows for arbitrary file download. This occurs when the application fails to properly validate user-supplied input used to construct a file path, enabling access to files outside the intended directory.