Permission model improperly protects against path traversal in Node.js 20