Fix read file path traversal vulnerability

[mdellweg]

CVE-2026-90959

📜 Checklist

• Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
• A changelog entry or entries has been added for any significant changes
• Follows the Pulp policy on AI Usage
• (For new features) - User documentation and test coverage has been added

See: Pull Request Walkthrough

[patchback]

Backport to 3.85: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.85/5436c6b595b907aecd1121bb8ff1406348eec959/pr-8125

Backported as #8128

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.73: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.73/5436c6b595b907aecd1121bb8ff1406348eec959/pr-8125

Backported as #8129

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.63: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.63/5436c6b595b907aecd1121bb8ff1406348eec959/pr-8125

Backported as #8130

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.49: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.49/5436c6b595b907aecd1121bb8ff1406348eec959/pr-8125

Backported as #8131

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.119: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.119/5436c6b595b907aecd1121bb8ff1406348eec959/pr-8125

Backported as #8132

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to 3.105: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.105/5436c6b595b907aecd1121bb8ff1406348eec959/pr-8125

Backported as #8133

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.