diff --git a/backend/converter.py b/backend/converter.py
index 583a818..c4e3eb4 100644
--- a/backend/converter.py
+++ b/backend/converter.py
@@ -49,7 +49,7 @@ def extract_if_needed(filename: str) -> Path:
     Accepts both absolute paths and paths relative to STAGING_IN."""
     filepath = Path(filename)
     if not filepath.is_absolute():
-        filepath = STAGING_IN / filename
+        filepath = STAGING_ROOT / filename
     if not filepath.exists():
         raise FileNotFoundError(f"Source not found: {filepath}")
 
diff --git a/backend/provisioner.py b/backend/provisioner.py
index d09a029..3e0a6e8 100644
--- a/backend/provisioner.py
+++ b/backend/provisioner.py
@@ -35,10 +35,12 @@ STAGING_IN = STAGING_ROOT / "in"
 STAGING_OUT = STAGING_ROOT / "out"
 
 def _staging_in(session_id: str = "") -> Path:
-    return STAGING_IN / session_id if session_id else STAGING_IN
+    base = STAGING_ROOT / session_id if session_id else STAGING_ROOT
+    return base / "in"
 
 def _staging_out(session_id: str = "") -> Path:
-    return STAGING_OUT / session_id if session_id else STAGING_OUT
+    base = STAGING_ROOT / session_id if session_id else STAGING_ROOT
+    return base / "out"
 
 # In-memory job tracking — survives as long as the process runs
 _jobs: dict[str, dict] = {}
diff --git a/frontend/app.py b/frontend/app.py
index eb4668e..a23ae1b 100644
--- a/frontend/app.py
+++ b/frontend/app.py
@@ -436,7 +436,8 @@ async def session_analyze(
         return render("_analysis.html", request=request, error=err)
 
     # Prepend session subdirectory to the filename for the backend
-    backend_filename = f"{session_id}/{filename}" if session_id else filename
+    # Files are in tmp/{guid}/in/, so the backend needs {guid}/in/filename
+    backend_filename = f"{session_id}/in/{filename}" if session_id else filename
 
     try:
         analysis = api.analyze(vmid=vmid, filename=backend_filename)