Arbitrary file read via path traversal

Path traversal in the Evidently UI service in Evidently 0.7.21 and earlier allows remote attackers to read arbitrary files via filename input. The /api/datasets/materialize endpoint accepts a user-controlled filename, FileDataSource passes it into FileIO, and FSLocation.open joins it to the workspace path with posixpath.join without normalization or containment checks, so ../ segments and absolute paths escape the workspace. In the default evidently ui configuration, NoSecurityComponent leaves the API unauthenticated; with authentication enabled, any authenticated user can exfiltrate reachable .csv or .parquet files and then retrieve their contents through dataset download routes.