Out-of-root file write via unchecked object keys

Path traversal in Juicedata JuiceFS 1.4.1 and earlier allows attackers to write files outside a local sync destination. The filestore path helper joins or cleans object keys under its root without checking that the resolved path remains contained, and Put writes attacker-supplied content there. Exploitation requires an operator to sync from an object store containing an attacker-controlled traversal key, and filesystem permissions bound the writable locations.