Using '/' as upload path allows to access system files

If I use uploads/<upload-id>/raw//, I get access to files outside of nomad's staging upload raw directory. Running the dev server on my computer, I get the contents of my root directory.