Security patch (files must stay in workdir)
Clean path in filemanager for prevent null bytes injection & go out of workdir