fixes #570

So I'm pretty sure this takes care of the issue.
This solution around walking the yaml dirs isn't very efficient.

A more efficient solution would be to sanitize the incoming paths to ensure they don't contain strings that would result in traversals, since you wouldn't need to do a bunch of disk seeks that way.