Out-of-directory writes via traversing package names

Path traversal in affected Umbraco CMS releases allows remote authenticated users to write folders outside the default package directory. The Backoffice Package section accepts ../ segments in an attacker-controlled package name and uses the resulting path without confining it to the package root. Exploitation requires a logged-in Backoffice account with package-creation permission and permits filesystem changes beyond package storage.