WIP

src/Service/DocumentStorageService.php

@@ -27,6 +27,10 @@ class DocumentStorageService
 
     public function getAbsolutePath(string $relativePath): string
     {
+        if (str_contains($relativePath, '..')) {
+            throw new RuntimeException(sprintf('Path traversal detected: "%s"', $relativePath));
+        }
+
         $absolutePath = $this->storageDir.'/'.$relativePath;
         $realPath     = realpath($absolutePath);