[SCHiM]

Sounds like a directory traversal to me :)

It's generally a bad idea to have the user in control of filenames you create if those files are not on a device they own.

[thaumasiotes]

In this case, it sounds like the files were on a device owned by the user?

[account42]

The user in control here is the one configuring the SSID, which is not necessarily the same one owning the device used to connect to it.

[gimboland]

I guess SCHiM means "own" as in "have administrative control over".