Is this a LFI vulnerability?

Question

I'm playing with uploads, so I'm wondering if this route is safe to use, because if you somehow break off from the md5 function path, then you can control the path (if in TypeScript null byte is a thing).

Note: Snyk denotes this as an LFI issue!

Finally, my question is this vulnerability or the Snyk just evaluates this way (because of variable names)? And also, is there any other way except the infamous null byte to bypass extensions?

The pseudocode is written in TS.

// ? This is pseudocode and it is not 100% valid.

router.post("/profile", async (req: Request, res: Response) => {
  if (img.mimetype === "image/png" || img.mimetype === "image/jpeg") {
    if (img.size < 1048576) {
      var user = { userName: "UserControlledInput", password: "password", email: "email" }
      if (user) {
        let imgName = md5('prefix' + user.userName);
        let imgPath = "assets/avatars/" + imgName + "." + img.mimetype.split("/")[1]
        fs.writeFile(path.join(__dirname, "../jekyll/_site/" + imgPath), img.buffer, async (err) => {
          if (err) {
            console.warn("Error:", err);
          } else {
            user.save_to_database()
            return res.send({ message: "Success!" });
          };
        })
      } else {
        res.send({ message: "First you must login, Not allowed!"})
      };
    } else {
      return res.send({ message: "Not allowed, files larger then 1MB." });
    };
  };
});