tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape ...