From 25d5189a7cc63fe2818b7fac69591933a9b9f414 Mon Sep 17 00:00:00 2001
From: Jamie Cameron <jcameron@webmin.com>
Date: Thu, 27 Aug 2026 21:39:41 -0700
Subject: [PATCH] Ensure detached filename is not a path

---
 mailboxes/reply_mail.cgi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/mailboxes/reply_mail.cgi b/mailboxes/reply_mail.cgi
index 465ab24ca..693077d76 100755
--- a/mailboxes/reply_mail.cgi
+++ b/mailboxes/reply_mail.cgi
@@ -146,6 +146,7 @@ else {
 					$attach->{'type'} =~ /\/(\S+)$/;
 					$fn = "file.$1";
 					}
+				$fn =~ s/^.*\///;
 				$path = "$in{'dir'}/$fn";
 				}
 			else {