(bug 27094) fix path traversal vulnerability