In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal. A patch is available on the master branch of the repository.
master