"managementServer.CreateSchematic" ("internal/backend/grpc/schematics.go") passes the caller-controlled "TalosVersion" field directly to "imageFactoryClient.OverlaysVersions", which embeds it verbatim into a "fmt.Sprintf("/version/%s/overlays/official", talosVersion)" path template. "url.URL.JoinPath" resolves any "../" sequences in that path, allowing an authenticated Operator to rewrite the URL path and force Omni to issue HTTP GET requests to unintended paths on the configured image-factory server. Error body content from those unintended endpoints is returned to the caller.