Fix subdir traversal