Unauthenticated file read and deletion via path traversal

Path traversal in ParisNeo LoLLMS 9.5 allows remote attackers to read or delete Windows files through crafted endpoint paths. The sanitize_path_from_endpoint function accepts backslash-based parent-directory segments, so personalities and /del_preset can resolve outside their intended directories. No authentication or user interaction is required when the service is network reachable; disclosure reaches readable files, while deletion can interrupt service.