NocoDB: Path Traversal via SQLite Source Filename

An authenticated user with base-create permission can attach a SQLite source pointing to an arbitrary file on the NocoDB host. The services accept a caller-supplied filename and pass it to `fs.exists` and `fs.open('w')` without restricting the location. This allows an attacker to point a source at internal NocoDB databases or any other writable path. The attacker can then read or overwrite the file's contents through the regular table APIs.

The vulnerability lies within the SQLite client and the base/integration create services. Specifically, these services accept a caller-supplied filename and pass it to `fs.exists` and `fs.open('w')` without proper location restriction.

The patch restricts the location where SQLite databases can be attached. It ensures that only files within designated directories are permitted, preventing the attachment of arbitrary files on the host system. This mitigates the risk of unauthorized access to or modification of sensitive NocoDB internal state or other tenant databases.