Crafted .relbak files with IDs like "../../.bashrc" could escape the target directory. Now validates that item/attachment IDs are hex-only via is_valid() before any fs::write. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Crafted .relbak files with IDs like "../../.bashrc" could escape the target directory. Now validates that item/attachment IDs are hex-only via is_valid() before any fs::write. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>