Unauthenticated code execution via extension path traversal

Path traversal in ParisNeo LoLLMs WebUI allows remote attackers to execute arbitrary code through the extension installer. The /install_extension handler passes the untrusted name parameter to ExtensionBuilder().build_extension(), which resolves and imports an attacker-controlled init.py outside the extension directory. The endpoint requires no authentication or user interaction; exploitation provides code execution under the server process when the WebUI is network-exposed or headless.