Contributor-level file overwrite via unvalidated destination path

Path traversal in Community Events Project Link Library before 7.9.6 allows remote authenticated users to write image files outside the site root. The image-generation handler uses the user-supplied filepath value as a destination directory without canonicalizing or restricting it before creating directories and writing a numerically named image. Contributor access or higher is required; the flaw can create directories and write or overwrite fixed-extension image files wherever the web server account has permission, but it cannot plant executable code.