Path traversal via backslash normalization discrepancy across FTP/SFTP handlers and VFS backends allows directory escape.

The Go project sftpgo contains a security vulnerability in the CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) class.

Audit the codebase for a vulnerability of this class. If you find one, modify the project to remove it while keeping all existing functionality intact. If you find no such vulnerability, make no changes.

The verifier compiles the project and runs tests that exercise path validation and path normalization routines with adversarial and benign inputs.