Path Traversal

htmlpublisher is vulnerable to path traversal. User input report names are not further validated and are employed as part of a URL and as a directory name, overriding files outside the build directory.