Fixed: path traversal attack