Arbitrary file write via unsanitized user_id path

Path traversal in OpenAgents ff2e46440699af1324eb25655b622c4a131265bb allows remote authenticated users to write uploads outside its data directory. The create_upload_file function passes request-supplied user_id data to create_personal_folder, sanitizes only the filename, joins both values, and saves the file at the resulting path. Access to the upload endpoint and control of user_id are required; successful exploitation writes attacker-supplied content to unintended server paths.