diff --git a/src/flask/helpers.py b/src/flask/helpers.py index d069e545b2..57c8a00054 100644 --- a/src/flask/helpers.py +++ b/src/flask/helpers.py @@ -546,7 +546,8 @@ def download_file(name): If the final path does not point to an existing regular file, raises a 404 :exc:`~werkzeug.exceptions.NotFound` error. - :param directory: The directory that ``path`` must be located under. This *must not* + :param directory: The directory that ``path`` must be located under, + relative to the current application's root path. This *must not* be a value provided by the client, otherwise it becomes insecure. :param path: The path to the file to send, relative to ``directory``.