https://www.drupal.org/node/2854498
Platform path is not sanitized as expected [#2854498] | Drupal.org
Mar 11, 2017 - While we have the hosting_path_normalize() procedure, it is not used when user submits the form, so it is still possible to enter incorrect path, like with...
as expectedplatformpathsanitizeddrupal