Unauthenticated arbitrary file write via traversal filename

Path traversal in openvpn-cms-flask 1.2.0 through 1.2.7 allows remote attackers to write arbitrary files via an upload filename. The upload() method joins the image filename directly to the configured upload directory and saves it without neutralizing relative path segments. The upload_to_local endpoint lacks authentication, so a multipart request can place attacker-controlled content outside the upload directory on the Linux server.