unquoted path vulnerability