Path traversal in SummaryController allows reading arbitrary .ttl files outside the summaries directory

[Michiel-VandeVelde]

The datasource name comes directly from the request path and can contain ../, allowing path.join to escape the configured summaries directory and serve arbitrary .ttl files. Resolve the path and reject traversal before opening it.