Arbitrary file write via unchecked folder path

Path traversal in AI Hispano Applio 3.2.8-bugfix and earlier allows remote attackers to write arbitrary files on the server. The create_folder_and_move_files function joins an unchecked folder_name value to custom_embedder_root and copies uploaded files without verifying that the destination remains beneath that root. Unauthenticated access to the Gradio endpoints is sufficient, and the write is limited to paths writable by the account running Applio; chained unsafe model deserialization can turn the write into code execution.