5328 validate report download path to prevent directory traversal