mod-workflow postHandleEventsWithFile Path Traversal vulnerability

https://github.com/folio-org/mod-workflow/blob/13289327f0b4c14364387fb50e00d5f6b3571306/service/src/main/java/org/folio/rest/workflow/controller/EventController.java#L93

overwrites a file at a path location provided in the HTTP request.

How is the .jar file protected from being overwritten (Remote Code Execution)?

How are files from tenant a being protected from getting overwritten by tenant b?

Learn more about Relative Path Traversal at https://cwe.mitre.org/data/definitions/23.html