I know the shell injection thing is bad, but would it be so bad to spawn a /bin/mkdir subprocess without a shell?
Leverage a lookup that says user input “../../../root” == code generated directory path.
You might need some additional checks, like for ../ and symlinks, but you need these regardless whether you execve or write your own mkdirp().