Root privilege escalation via traversed module path

Path traversal in LinuxCNC before 2.9.9 allows local users to escalate privileges to root through a crafted rtapi_app module name. The SUID-root rtapi_app constructs a shared-object path from an unchecked module name and passes it to dlopen(), permitting slash or dot-dot traversal. An unprivileged local user can load an attacker-controlled library into the still-privileged process and obtain root privileges.