Directory traversal in .rjs files allows to place file in any directory.
vulners.com/securityvulns/securityvulns:doc:5746