HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.
