File writes via unvalidated storage paths

Path traversal in Django 4.2 before 4.2.14 and 5.0 before 5.0.7 allows attackers to write files outside the storage root. Storage.save() passed an unvalidated name toward the storage backend; custom Storage subclasses that omit generate_filename() validation can accept absolute paths or parent-directory components. Exposure requires an application to use such a custom subclass and pass attacker-controlled file names; built-in Storage subclasses are unaffected.