TrafficRecorder::Recording::_getPath() (src/mongo/db/traffic_recorder.cpp:325-339) validates a caller-supplied 'destination' by comparing the un-resolved parent path of <baseDir>/<destination> against the normalized baseDir. Because std::filesystem::path::parent_path() is purely lexical (it does not collapse ".." components), a destination of ".." yields a path whose parent_path() is exactly baseDir, so the "must be a simple filename" check at line 335-338 passes even though the resulting path is baseDir/.. — one directory above the configured recording directory.