When attempting to write_property_bytes, for example, the user can specify any number of ../ parts for the file they want to write to and therefore can access the whole system from within FPGAd. Currently FPGAd only checked that the start of the path is within /sys/class/fpga_manager/ dir, but imagine the user put /sys/class/fpga_manager/../../../usr/bin/evil_file.sh?!
When installed as a snap, the snap confinement should protect against this, and without that, the service should require sudo to write anyway, but this should be handled (just don't allow ../?).