[Security] Potential Directory Traversal in File Upload Handling

# [Security] Potential Directory Traversal in File Upload Handling

Hi maintainers,

While reviewing the file upload implementation, I identified what appears to be a potential directory traversal issue related to user-controlled filenames.

I was able to reproduce the behavior in a controlled local test environment using the current upload logic. The issue may allow files to be written outside the intended upload directory if filenames are not properly sanitized.

Since this appears to be security-related, I would prefer not to disclose full details publicly.

Could you please let me know if there is a preferred private channel (email or security contact) where I can responsibly share the proof of concept and a proposed fix?

Happy to help with a patch once coordinated.

Thank you.