Arbitrary file write via unsanitized folder path

Path traversal in ComfyUI before 0.30.0 allows attackers to write files outside the output directory by running a crafted workflow. In comfy_extras/nodes_dataset.py, dataset save nodes join the free-form folder_name value to the output directory without containment checks, then write attacker-controlled captions, images, or serialized data. Execution requires a user to load and run the workflow; writes to startup files or package initializers execute code under that user's account.