Arbitrary file modification via package path traversal

Path traversal in Numbas editor before 7.3 allows attackers to modify files outside editable theme and extension directories. Editable-package forms and views join attacker-controlled filenames to a package extraction path without resolving and enforcing containment before writing or deleting files. Ability to submit package-editing requests is required; traversal can overwrite or delete files reachable by the editor process, and a published exploit chains the write to code execution.