Directory traversal in Profile Picture path - leads to privilege escalation in < 3.0

Confluence allows directory traversal in Profile Picture path leading to privilege escalation in versions less than 3.0. Lack of validation for userProfilePictureName parameter allows attackers to specify any URL as Profile Picture, potentially gaining administrative access