Authenticated arbitrary file write via unsanitized import filename

Path traversal in Bolo-Solo 2.6.0 through 2.6.4 allows remote authenticated users to write arbitrary files via a crafted import filename. The importFromCnblogs method writes the multipart file under its supplied filename without validating or constraining the destination path, and cleanup misses files placed outside temp/file. An authenticated import request can therefore leave attacker-controlled content anywhere writable by the application process.