CVE-2026-71313

## Summary The local backend relies on its configurable filename encoder to prevent remote filename data from becoming operating-system path syntax. If a local destination uses an encoding that omits `Dot`, such as `Slash`, `None`, or `Raw`, a remote object's standard-encoded `．．` component is decoded into an actual `..` component. `backend/local.localPath` then passes the decoded name to `filepath.Join`, which resolves the component and produces a path outside the configured local root. An at