Unauthenticated limited file write via data_dir traversal

Path traversal in Fish Audio Bert-VITS2 allows remote attackers to write config.json outside the intended data directory. generate_config passes the unvalidated data_dir value through get_path, joins it beneath ./data, then creates directories and writes the resulting configs/config.json path without containment checks. The Gradio preprocessing interface must be running and reachable; the write is limited to a config.json under an existing attacker-selected directory, while errors also disclose whether directories exist.