Some of them can't be reasonably fixed (doing a path_is_under() check on all ".." traversals would fix most security bugs -- but it would make all path lookups

Some of them can't be reasonably fixed (doing a path_is_under() check on all ".." traversals would fix most security bugs -- but it would make all path lookups be O(n^2) which is unacceptable) and there is also the risk of yet-unknown attacks.