Expected Findings
- Upload endpoint trusts file names and types.
- File viewer supports traversal-like names directly.
This upload form accepts arbitrary file names and the file viewer happily reads traversal-style paths from the request.
if (filename.length > 0) store(filename, blob)