Authenticated arbitrary file write via traversal filename

Path traversal in Heym before 0.0.21 allows remote authenticated users to write files outside the upload storage directory. The upload_file handler passes the multipart filename to store_file, which joins it into a filesystem path without rejecting path components or checking resolved-path containment. Any signed-in user can supply traversal segments to write attacker-controlled bytes as the backend process user; reads and deletion depend on subsequent access to the planted path.