Attachment commands.
Downloads write files that came from other people. The destination is always explicit and never inferred from a server-supplied filename, so a crafted attachment name cannot decide where bytes land.