Add security check for ".." in path.