Details of the parse_filepath() vuln?

[Endoisshy]

Can you provide more detail about where you saw this function and how it lead you to finding the vulnerability? Following your write up the vulnerability itself makes sense, but where did you find this?

[qxxxb]

I updated the write-up a bit show where the vulnerable function is