[HIGH] CWE-22 — Path Traversal in FTP Wildcard Download via Unencoded `.` in Escaped Filenames

Summary A malicious or MITM'd FTP server can cause a client using `CURLOPT_WILDCARDMATCH` to download files outside the intended remote directory, by returning a LIST response with a filename containing `..` path-traversal sequences.

After URL-decoding in ftp_parse_url_path(), validate that the resulting
path does not contain ".." components that traverse outside the intended
directory. Alternatively, validate finfo->filename in the
CURLWC_DOWNLOADING state before it is ever escaped reject filenames
containing "/", "..", or an …