cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/upload.py b/evaluation/ai-assistant/backend/routers/upload.py
--- a/evaluation/ai-assistant/backend/routers/upload.py
+++ b/evaluation/ai-assistant/backend/routers/upload.py
@@ -264,13 +264,22 @@
 
 @router.post("/columns-from-path")
 async def get_csv_columns_from_path(req: dict):
-    """Read the header row of a CSV at the given absolute path."""
-    file_path = os.path.expanduser(req.get("path", ""))
-    if not file_path or not os.path.isabs(file_path):
-        raise HTTPException(status_code=400, detail="Path must be absolute.")
-    if not os.path.isfile(file_path):
-        raise HTTPException(status_code=400, detail=f"File not found: {file_path}")
-    with open(file_path, encoding="utf-8") as f:
+    """Read the header row of a CSV at the given path under the project root."""
+    raw_path = (req.get("path") or "").strip()
+    if not raw_path:
+        raise HTTPException(status_code=400, detail="Path is required.")
+    # Resolve the user-supplied path against the project root and ensure it stays within it.
+    candidate_path = os.path.realpath(os.path.join(_PROJECT_ROOT, raw_path))
+    try:
+        common = os.path.commonpath([_PROJECT_ROOT, candidate_path])
+    except ValueError:
+        # Different drives or invalid paths
+        raise HTTPException(status_code=400, detail="Invalid path.")
+    if common != _PROJECT_ROOT:
+        raise HTTPException(status_code=400, detail="Access to this path is not allowed.")
+    if not os.path.isfile(candidate_path):
+        raise HTTPException(status_code=400, detail=f"File not found: {raw_path}")
+    with open(candidate_path, encoding="utf-8") as f:
         head = f.read(65_536)
     reader = csv.DictReader(io.StringIO(head))
     columns = list(reader.fieldnames or [])
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/upload.py b/evaluation/ai-assistant/backend/routers/upload.py
--- a/evaluation/ai-assistant/backend/routers/upload.py
+++ b/evaluation/ai-assistant/backend/routers/upload.py
@@ -81,6 +81,32 @@
     return os.path.normpath(os.path.join(_PROJECT_ROOT, path))
 
 
+def _resolve_safe_path(user_path: str) -> str:
+    """
+    Resolve a user-provided path to a location under the managed data directory.
+
+    The returned path is guaranteed to be contained within ``_DATA_DIR`` or an
+    HTTPException is raised.
+    """
+    if not user_path:
+        raise HTTPException(status_code=400, detail="Path is required.")
+
+    expanded = os.path.expanduser(user_path)
+
+    # Treat absolute paths as paths relative to the data directory root
+    if os.path.isabs(expanded):
+        expanded = expanded.lstrip(os.sep)
+
+    candidate = os.path.normpath(os.path.join(_DATA_DIR, expanded))
+
+    data_dir_norm = os.path.normpath(_DATA_DIR)
+    # Ensure the candidate path is inside _DATA_DIR
+    if not (candidate == data_dir_norm or candidate.startswith(data_dir_norm + os.sep)):
+        raise HTTPException(status_code=400, detail="Path not allowed.")
+
+    return candidate
+
+
 def _ensure_stored_copy(dataset_id: str) -> UploadedDataset:
     """Ensure a dataset has a managed copy under backend/data."""
     ds = _uploaded.get(dataset_id)
@@ -264,10 +290,9 @@
 
 @router.post("/columns-from-path")
 async def get_csv_columns_from_path(req: dict):
-    """Read the header row of a CSV at the given absolute path."""
-    file_path = os.path.expanduser(req.get("path", ""))
-    if not file_path or not os.path.isabs(file_path):
-        raise HTTPException(status_code=400, detail="Path must be absolute.")
+    """Read the header row of a CSV at the given path under the data directory."""
+    raw_path = req.get("path", "")
+    file_path = _resolve_safe_path(raw_path)
     if not os.path.isfile(file_path):
         raise HTTPException(status_code=400, detail=f"File not found: {file_path}")
     with open(file_path, encoding="utf-8") as f:
@@ -287,7 +312,7 @@
 
 @router.post("/load")
 async def load_dataset(req: DatasetLoadRequest):
-    """Load a CSV or JSON file from a local absolute path."""
+    """Load a CSV or JSON file from a local path under the data directory."""
     if req.format not in ("csv", "json"):
         raise HTTPException(
             status_code=400,
@@ -297,9 +322,7 @@
             ),
         )
 
-    file_path = os.path.expanduser(req.path)
-    if not os.path.isabs(file_path):
-        raise HTTPException(status_code=400, detail="Path must be absolute.")
+    file_path = _resolve_safe_path(req.path)
     if not os.path.isfile(file_path):
         raise HTTPException(status_code=400, detail=f"File not found: {file_path}")
 
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/upload.py b/evaluation/ai-assistant/backend/routers/upload.py
--- a/evaluation/ai-assistant/backend/routers/upload.py
+++ b/evaluation/ai-assistant/backend/routers/upload.py
@@ -46,7 +46,10 @@
 _DATA_DIR = os.path.join(os.path.dirname(os.path.dirname(__file__)), "data")
 os.makedirs(_DATA_DIR, exist_ok=True)
 
+# Root directory from which users are allowed to load files by path
+_ALLOWED_DATA_ROOT = _DATA_DIR
 
+
 def _save_registry() -> None:
     """Persist the dataset registry to disk."""
     data = [ds.model_dump() for ds in _uploaded.values()]
@@ -81,6 +83,37 @@
     return os.path.normpath(os.path.join(_PROJECT_ROOT, path))
 
 
+def _resolve_user_file_path(raw_path: str) -> str:
+    """
+    Resolve and validate a user-supplied file path so that it stays under _ALLOWED_DATA_ROOT.
+
+    The returned path is an absolute, normalized path pointing to an existing regular file.
+    """
+    if not raw_path:
+        raise HTTPException(status_code=400, detail="Path is required.")
+
+    # Expand '~' and environment variables, then resolve symlinks and '..'.
+    expanded = os.path.expanduser(raw_path)
+    if not expanded:
+        raise HTTPException(status_code=400, detail="Path is required.")
+
+    # Allow both absolute and relative inputs, but always interpret them under _ALLOWED_DATA_ROOT.
+    if os.path.isabs(expanded):
+        candidate = os.path.realpath(expanded)
+    else:
+        candidate = os.path.realpath(os.path.join(_ALLOWED_DATA_ROOT, expanded))
+
+    allowed_root = os.path.realpath(_ALLOWED_DATA_ROOT)
+    # Ensure the candidate path is within the allowed root directory.
+    if os.path.commonpath([allowed_root, candidate]) != allowed_root:
+        raise HTTPException(status_code=400, detail="Access to the requested path is not allowed.")
+
+    if not os.path.isfile(candidate):
+        raise HTTPException(status_code=400, detail=f"File not found: {candidate}")
+
+    return candidate
+
+
 def _ensure_stored_copy(dataset_id: str) -> UploadedDataset:
     """Ensure a dataset has a managed copy under backend/data."""
     ds = _uploaded.get(dataset_id)
@@ -264,12 +297,9 @@
 
 @router.post("/columns-from-path")
 async def get_csv_columns_from_path(req: dict):
-    """Read the header row of a CSV at the given absolute path."""
-    file_path = os.path.expanduser(req.get("path", ""))
-    if not file_path or not os.path.isabs(file_path):
-        raise HTTPException(status_code=400, detail="Path must be absolute.")
-    if not os.path.isfile(file_path):
-        raise HTTPException(status_code=400, detail=f"File not found: {file_path}")
+    """Read the header row of a CSV at the given path under the allowed data root."""
+    raw_path = req.get("path", "")
+    file_path = _resolve_user_file_path(raw_path)
     with open(file_path, encoding="utf-8") as f:
         head = f.read(65_536)
     reader = csv.DictReader(io.StringIO(head))
@@ -287,7 +317,7 @@
 
 @router.post("/load")
 async def load_dataset(req: DatasetLoadRequest):
-    """Load a CSV or JSON file from a local absolute path."""
+    """Load a CSV or JSON file from a local path under the allowed data root."""
     if req.format not in ("csv", "json"):
         raise HTTPException(
             status_code=400,
@@ -297,11 +327,7 @@
             ),
         )
 
-    file_path = os.path.expanduser(req.path)
-    if not os.path.isabs(file_path):
-        raise HTTPException(status_code=400, detail="Path must be absolute.")
-    if not os.path.isfile(file_path):
-        raise HTTPException(status_code=400, detail=f"File not found: {file_path}")
+    file_path = _resolve_user_file_path(req.path)
 
     file_size = os.path.getsize(file_path)
     if file_size > MAX_FILE_SIZE:
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/presidio_service.py b/evaluation/ai-assistant/backend/routers/presidio_service.py
--- a/evaluation/ai-assistant/backend/routers/presidio_service.py
+++ b/evaluation/ai-assistant/backend/routers/presidio_service.py
@@ -205,11 +205,32 @@
     global _engine
 
     if req.config_path:
-        if not os.path.isabs(req.config_path):
-            raise HTTPException(status_code=400, detail="Config path must be an absolute path.")
-        if not os.path.isfile(req.config_path):
-            raise HTTPException(status_code=400, detail=f"Config file not found: {req.config_path}")
+        raw_path = req.config_path
+        try:
+            resolved_path = Path(raw_path).resolve()
+        except Exception:
+            raise HTTPException(status_code=400, detail="Invalid config path.")
 
+        # Ensure the config file resides within the Presidio data directory
+        try:
+            is_within_data_dir = resolved_path.is_relative_to(_DATA_DIR)
+        except AttributeError:
+            # Fallback for Python versions without Path.is_relative_to
+            try:
+                resolved_data_dir = _DATA_DIR.resolve()
+            except Exception:
+                raise HTTPException(status_code=500, detail="Server configuration error.")
+            is_within_data_dir = resolved_path == resolved_data_dir or resolved_data_dir in resolved_path.parents
+
+        if not is_within_data_dir:
+            raise HTTPException(status_code=400, detail="Config path must be inside the server config directory.")
+
+        if not resolved_path.is_file():
+            raise HTTPException(status_code=400, detail=f"Config file not found: {raw_path}")
+
+        # Use the normalized, safe path from here on
+        req.config_path = str(resolved_path)
+
     # Reset
     _engine = None
     _state["loading"] = True
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/presidio_service.py b/evaluation/ai-assistant/backend/routers/presidio_service.py
--- a/evaluation/ai-assistant/backend/routers/presidio_service.py
+++ b/evaluation/ai-assistant/backend/routers/presidio_service.py
@@ -60,6 +60,7 @@
 # Per-config results accumulator (replaces run snapshots)
 # ---------------------------------------------------------------------------
 _DATA_DIR = Path(__file__).resolve().parent.parent / "data"
+_CONFIGS_ROOT = Path(__file__).resolve().parent.parent / "configs"
 
 # config_name -> {rec_id -> entities}
 _all_config_results: dict[str, dict[str, list]] = {}
@@ -123,16 +124,28 @@
         raise HTTPException(status_code=400, detail="Name may only contain letters, numbers, hyphens, underscores, dots, and spaces.")
     if not path:
         raise HTTPException(status_code=400, detail="Config path is required.")
-    if not os.path.isabs(path):
-        raise HTTPException(status_code=400, detail="Config path must be absolute.")
-    if not os.path.isfile(path):
+
+    # Treat the provided path as relative to a trusted configs root and
+    # validate that the normalized path stays within that root.
+    # Disallow absolute paths outright.
+    if os.path.isabs(path):
+        raise HTTPException(status_code=400, detail="Config path must be relative to the server configs directory.")
+    # Build and normalize the full path under the configs root
+    _CONFIGS_ROOT.mkdir(parents=True, exist_ok=True)
+    fullpath = os.path.normpath(os.path.join(str(_CONFIGS_ROOT), path))
+    # Ensure the normalized path is still within the configs root
+    configs_root_str = str(_CONFIGS_ROOT.resolve())
+    fullpath_resolved = os.path.realpath(fullpath)
+    if not fullpath_resolved.startswith(configs_root_str + os.sep) and fullpath_resolved != configs_root_str:
+        raise HTTPException(status_code=400, detail="Config path is not allowed.")
+    if not os.path.isfile(fullpath_resolved):
         raise HTTPException(status_code=400, detail=f"Config file not found: {path}")
 
     # Copy the config file into our data/ folder so we own the copy
     _DATA_DIR.mkdir(parents=True, exist_ok=True)
     safe_name = name.replace(" ", "_").replace("/", "_")
     dest = _DATA_DIR / f"config-{safe_name}.yml"
-    shutil.copy2(path, dest)
+    shutil.copy2(fullpath_resolved, dest)
     abs_path = str(dest.resolve())
 
     user_configs = _get_user_configs()
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/presidio_service.py b/evaluation/ai-assistant/backend/routers/presidio_service.py
--- a/evaluation/ai-assistant/backend/routers/presidio_service.py
+++ b/evaluation/ai-assistant/backend/routers/presidio_service.py
@@ -128,11 +128,17 @@
     if not os.path.isfile(path):
         raise HTTPException(status_code=400, detail=f"Config file not found: {path}")
 
+    # Restrict source config files to live under the data directory (or a subdirectory)
+    base_path = os.path.realpath(str(_DATA_DIR))
+    source_path = os.path.realpath(path)
+    if os.path.commonpath([base_path, source_path]) != base_path:
+        raise HTTPException(status_code=400, detail="Config path must be located under the allowed data directory.")
+
     # Copy the config file into our data/ folder so we own the copy
     _DATA_DIR.mkdir(parents=True, exist_ok=True)
     safe_name = name.replace(" ", "_").replace("/", "_")
     dest = _DATA_DIR / f"config-{safe_name}.yml"
-    shutil.copy2(path, dest)
+    shutil.copy2(source_path, dest)
     abs_path = str(dest.resolve())
 
     user_configs = _get_user_configs()
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/upload.py b/evaluation/ai-assistant/backend/routers/upload.py
--- a/evaluation/ai-assistant/backend/routers/upload.py
+++ b/evaluation/ai-assistant/backend/routers/upload.py
@@ -73,7 +73,11 @@
     os.path.join(os.path.dirname(__file__), "..", "..")
 )
 
+# Root directory for user-loadable files; all user-specified paths must resolve here
+_IMPORT_ROOT = os.path.join(_PROJECT_ROOT, "import")
+os.makedirs(_IMPORT_ROOT, exist_ok=True)
 
+
 def _resolve_path(path: str) -> str:
     """Resolve a path; relative paths are resolved against the project root."""
     if os.path.isabs(path):
@@ -81,6 +84,29 @@
     return os.path.normpath(os.path.join(_PROJECT_ROOT, path))
 
 
+def _resolve_user_path(raw_path: str) -> str:
+    """
+    Resolve a user-supplied path safely under _IMPORT_ROOT.
+
+    The returned path is guaranteed to be within _IMPORT_ROOT, or an HTTPException is raised.
+    """
+    if not raw_path:
+        raise HTTPException(status_code=400, detail="Path is required.")
+    expanded = os.path.expanduser(raw_path)
+    # If the user supplied an absolute path, use it as-is; otherwise, resolve relative to _IMPORT_ROOT.
+    if os.path.isabs(expanded):
+        candidate = expanded
+    else:
+        candidate = os.path.join(_IMPORT_ROOT, expanded)
+    # Normalize and resolve symlinks
+    real_path = os.path.realpath(candidate)
+    import_root_real = os.path.realpath(_IMPORT_ROOT)
+    # Ensure the resolved path is inside the allowed import root
+    if os.path.commonpath([real_path, import_root_real]) != import_root_real:
+        raise HTTPException(status_code=400, detail="Path is outside the allowed import directory.")
+    return real_path
+
+
 def _ensure_stored_copy(dataset_id: str) -> UploadedDataset:
     """Ensure a dataset has a managed copy under backend/data."""
     ds = _uploaded.get(dataset_id)
@@ -264,10 +290,9 @@
 
 @router.post("/columns-from-path")
 async def get_csv_columns_from_path(req: dict):
-    """Read the header row of a CSV at the given absolute path."""
-    file_path = os.path.expanduser(req.get("path", ""))
-    if not file_path or not os.path.isabs(file_path):
-        raise HTTPException(status_code=400, detail="Path must be absolute.")
+    """Read the header row of a CSV at the given path under the import directory."""
+    raw_path = req.get("path", "")
+    file_path = _resolve_user_path(raw_path)
     if not os.path.isfile(file_path):
         raise HTTPException(status_code=400, detail=f"File not found: {file_path}")
     with open(file_path, encoding="utf-8") as f:
@@ -287,7 +312,7 @@
 
 @router.post("/load")
 async def load_dataset(req: DatasetLoadRequest):
-    """Load a CSV or JSON file from a local absolute path."""
+    """Load a CSV or JSON file from a local path under the import directory."""
     if req.format not in ("csv", "json"):
         raise HTTPException(
             status_code=400,
@@ -297,9 +322,7 @@
             ),
         )
 
-    file_path = os.path.expanduser(req.path)
-    if not os.path.isabs(file_path):
-        raise HTTPException(status_code=400, detail="Path must be absolute.")
+    file_path = _resolve_user_path(req.path)
     if not os.path.isfile(file_path):
         raise HTTPException(status_code=400, detail=f"File not found: {file_path}")
 
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/upload.py b/evaluation/ai-assistant/backend/routers/upload.py
--- a/evaluation/ai-assistant/backend/routers/upload.py
+++ b/evaluation/ai-assistant/backend/routers/upload.py
@@ -337,7 +337,11 @@
     safe_ds_name = display_name.replace(" ", "_").replace("/", "_")
     stored_filename = f"{safe_ds_name}_{uid}{ext}"
     stored_path = os.path.join(_DATA_DIR, stored_filename)
-    shutil.copy2(file_path, stored_path)
+    normalized_data_dir = os.path.normpath(os.path.abspath(_DATA_DIR))
+    normalized_stored_path = os.path.normpath(os.path.abspath(stored_path))
+    if os.path.commonpath([normalized_stored_path, normalized_data_dir]) != normalized_data_dir:
+        raise HTTPException(status_code=400, detail="Invalid dataset name.")
+    shutil.copy2(file_path, normalized_stored_path)
 
     description = req.description.strip() if req.description else ""
     dataset = UploadedDataset(
@@ -346,7 +350,7 @@
         name=display_name,
         description=description,
         path=file_path,
-        stored_path=stored_path,
+        stored_path=normalized_stored_path,
         format=req.format,
         record_count=len(records),
         has_entities=has_entities,
EOF

cat << 'EOF' | git apply
diff --git a/evaluation/ai-assistant/backend/routers/upload.py b/evaluation/ai-assistant/backend/routers/upload.py
--- a/evaluation/ai-assistant/backend/routers/upload.py
+++ b/evaluation/ai-assistant/backend/routers/upload.py
@@ -46,7 +46,11 @@
 _DATA_DIR = os.path.join(os.path.dirname(os.path.dirname(__file__)), "data")
 os.makedirs(_DATA_DIR, exist_ok=True)
 
+# Root directory for dataset source files (restrict all resolved paths to this tree)
+_DATASETS_ROOT = os.path.join(_DATA_DIR, "datasets")
+os.makedirs(_DATASETS_ROOT, exist_ok=True)
 
+
 def _save_registry() -> None:
     """Persist the dataset registry to disk."""
     data = [ds.model_dump() for ds in _uploaded.values()]
@@ -75,12 +78,40 @@
 
 
 def _resolve_path(path: str) -> str:
-    """Resolve a path; relative paths are resolved against the project root."""
+    """Resolve a dataset path safely under the datasets root directory.
+
+    Absolute paths and paths that escape the configured datasets root are rejected.
+    """
+    # Reject absolute paths to avoid pointing outside the managed datasets tree
     if os.path.isabs(path):
-        return path
-    return os.path.normpath(os.path.join(_PROJECT_ROOT, path))
+        raise HTTPException(
+            status_code=400,
+            detail="Absolute paths are not allowed for dataset files.",
+        )
 
+    # Resolve relative path against the dedicated datasets root
+    candidate = os.path.normpath(os.path.join(_DATASETS_ROOT, path))
 
+    # Ensure the normalized path stays within the datasets root (prevents '..' escape)
+    datasets_root_norm = os.path.normpath(_DATASETS_ROOT)
+    try:
+        common = os.path.commonpath([datasets_root_norm, candidate])
+    except ValueError:
+        # On path-type mismatch, treat as invalid
+        raise HTTPException(
+            status_code=400,
+            detail="Invalid dataset path.",
+        )
+
+    if common != datasets_root_norm:
+        raise HTTPException(
+            status_code=400,
+            detail="Dataset path escapes the allowed datasets directory.",
+        )
+
+    return candidate
+
+
 def _ensure_stored_copy(dataset_id: str) -> UploadedDataset:
     """Ensure a dataset has a managed copy under backend/data."""
     ds = _uploaded.get(dataset_id)
@@ -98,8 +126,10 @@
         )
 
     ext = os.path.splitext(resolved)[1] or ".csv"
-    safe_name = ds.name.replace(" ", "_").replace("/", "_")
-    stored_filename = f"{safe_name}_{dataset_id}{ext}"
+    # Sanitize dataset name and id to avoid injecting path separators or special chars
+    safe_name = re.sub(r"[^A-Za-z0-9_.\-]+", "_", ds.name.strip()) or "dataset"
+    safe_id = re.sub(r"[^A-Za-z0-9_.\-]+", "_", dataset_id)
+    stored_filename = f"{safe_name}_{safe_id}{ext}"
     stored_path = os.path.join(_DATA_DIR, stored_filename)
 
     shutil.copy2(resolved, stored_path)
EOF