Publish copies the addon id and variant id from .treeinfo into addonid and variantid with no path check (pulprpm/app/kickstart/treeinfo.py). RpmPublication.populate() then calls os.mkdir(name) with that string (pulprpm/app/tasks/publishing.py) and writes the synced metadata and packages under that name. os.mkdir does not create missing parents, and it fails when the path already exists, so an existing file is not replaced. A ".." component or an absolute id whose parent exists leaves the worker temporary directory. The same code runs for any repository version that contains a distribution tree. No extra setting selects it. Introduced with kickstart publishing in 8a8048e2, tag 3.0.0b5, and every stable release from 3.2.0.