Authenticated arbitrary file write via folder traversal

Path traversal in Ecommerce-CodeIgniter-Bootstrap allows remote authenticated users to write image files outside the intended directory. The do_upload_others_images handler concatenates the folder POST value into its upload path, creates that path, and gives it to the upload library without canonicalization or a boundary check. A normal vendor session is required; only image-extension files were verified, so code execution is not established.