At https://bugs.kali.org/login_page.php#login-box:~:text=Warning:%20%22path%22%20was%20not%20defined%20in%20config_inc.php.%20Leaving%20it%20empty%20is%20a%20security%20risk%2C%20as%20the%20path%20will%20be%20set%20based%20on%20headers%20from%20the%20HTTP%20request%2C%20exposing%20your%20system%20to%20Host%20Header%20Injection%20attacks, I see:

Warning: "path" was not defined in config_inc.php. Leaving it empty is a security risk, as the path will be set based on headers from the HTTP request, exposing your system to Host Header Injection attacks.