Let's say I have this controller action

    public IActionResult LandingPage(string path)
    {
        ViewBag.path = path;
        return View();
    }

and in that view is just javascript that will take that path variable out of the viewbag and redirect to whatever's in it like below

<script>         
    var path= '@ViewBag.path';
    window.location.replace('../' + path);
</script>

essentially allowing for the client to reach any path on the site. Does this pose any security risks in allowing a savvy user to put whatever they want in the redirect path?