return null;
        }

        // Validate path to prevent path traversal attacks
        if (expectedBaseDir != null && !isValidUploadPath(uploadFile, expectedBaseDir)) {
            logger.warn("Path traversal attempt detected: fileName={}", fileName);

    private Boolean invokeIsValidUploadPath(File file, File baseDir) throws Exception {
        Method method = AdminDesignAction.class.getDeclaredMethod("isValidUploadPath", File.class, File.class);
        method.setAccessible(true);
        return (Boolean) method.invoke(action, file, baseDir);
    }

    private Boolean invokeIsValidVirtualHostPath(String path) throws Exception {