Fix high-severity bug 'application exposed to path traversal attack'