Fix isSubPath to allow filenames starting with ".."

internal/storage/local.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 // LocalStorage implements StorageBackend using the local filesystem.
@@ -87,5 +88,10 @@ func isSubPath(base, target string) bool {
 	if err != nil {
 		return false
 	}
-	return rel != ".." && !filepath.IsAbs(rel) && rel[:2] != ".."
+	if filepath.IsAbs(rel) {
+		return false
+	}
+	// Reject paths that escape the base directory.
+	// filepath.Rel returns ".." or starts with "../" for paths outside base.
+	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
 }