Arbitrary file writes and deletion via packageName traversal

Path traversal in SiYuan before 3.7.4 allows remote authenticated users with administrator access to write files or delete directories. The shared getPackageInstallPath function passes the client-controlled packageName through filepath.Join without boundary validation, after which installation copies package contents to the resolved path and uninstallation passes it to os.RemoveAll. All ten Bazaar package endpoints require an authenticated administrator, and kernel process permissions bound the writable or deletable locations.