Arbitrary file writes via unvalidated upload filenames

Path traversal in FileCodeBox 2.2 and earlier allows remote attackers to write arbitrary files through unauthenticated uploads. SystemFileStorage.save_file in core/storage.py joins an attacker-controlled multipart filename to its storage root without validating traversal sequences before creating directories and writing the file. The /share/file/ endpoint needs no authorization, but exploitation requires local filesystem storage and writes with the service process's filesystem permissions.