CVE-2026-73646: Unvalidated Extension Path Traversalcve-2026-73646-unvalidated-extension-path-traversal
Validating only a file extension with a regular expression before reading from the filesystem does not prevent path traversal. Verify that the path does not escape the base directory using path.relative() or path containment checks.
