/@fs/ dir traversal with escaped chars (fixes #8498)

Editor assessment

The `fix` type is appropriate for a security-sensitive directory traversal issue, and the subject manages to stay readable at under 72 characters even with both the issue reference `fixes #8498` and the PR number attached. Starting lowercase and omitting a trailing period follows convention. The main gap is the missing scope: something like `fix(server): ...` would have pinpointed the affected area, and the phrase 'escaped chars' is terse enough that a body explaining the attack vector and its impact would help changelog readers gauge severity. Still, a compact, well-referenced fix commit.