Hugging Face Datasets folder-based builder has a path traversal vulnerability

Hugging Face Datasets 5.0.0 and earlier versions have a path traversal vulnerability, fixed in commit f989ef9. The issue is that the folder-based dataset builder does not sufficiently validate the file_name metadata field before concatenating it directly with the dataset directory. An attacker can construct a file_name value with directory traversal sequences to read arbitrary local files, which are written into the output content when save_to_disk or push_to_hub is called.