File path disclosure fixes