I had not considered removing dotdot-sequences from URLs when the dots are URL encoded! There is always another level of "fun" with URLs.https://github.com/curl/curl/pull/16870