Plugins extend fyuhls, but they need to stay inside the app’s safety guardrails.

• keep plugin paths confined to the expected plugin base
• treat ZIP extraction and path handling carefully
• do not assume the plugin loader will trust arbitrary filesystem targets

Plugin autoload and extraction handling are more defensive now, so loose path assumptions that might have worked before are more likely to be blocked.

• validate plugin paths
• keep plugin file names clean
• review activation behavior on a staging copy first