Arbitrary file write via traversal filename

Path traversal in AstrBot 3.5.22 and earlier allows remote attackers to write arbitrary files via a crafted plugin-upload filename. The install_plugin_upload handler concatenates the multipart filename into data/temp without validation and passes the resulting path to file.save. No authentication or user interaction is required, and a failed archive parse leaves the attacker-controlled file at the traversed location.