Unfortunately, the raw file name is used in the download URL, so an attacker can abuse the menu parameter to "climb out" of the directory that holds the menu PDFs.
menu
Authentic artisanal spider-meat burgers, freshly shaved.
A vending machine that just serves Kimchi.
Freshly roast espressos served by glassy-eyed hipsters who would clearly prefer to be somewhere else right now.