Fix for #166298, and plug security hole (don't write to insecure dir