@dbs@edsu After some lunchtime reflection, I do wonder if it would be possible to code up a RCE based on a report name with invalid characters in it. There must be some relationship between report names and file names if slashes are disallowed, after all.