Arbitrary file placement via unchecked move destination

Path traversal in October CMS 1.0.319 through 1.0.465 allows remote authenticated users to place allowed files outside the assets directory. The AssetList::onMove handler accepts the dest request parameter, derives a destination without canonicalizing it, and moves the selected asset without confirming that the result remains beneath the configured assets root. Backend access with the cms.manage_assets permission is required; successful exploitation writes a whitelisted file into any server directory writable by the web process.