I've the feeling which the DEPTH of the traversal attack should be configurable, just in case there isn't a default installation. Even when the installer uses a defaut installation path!