Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)

The Kitty graphics protocol handler in rio-vt builds a filesystem path from an attacker-controlled APC escape sequence and, for the temp-file medium, only checks that the path contains the substring "tty-graphics-protocol" before it opens, reads, and removefiles it. There is no .. rejection and n...