AIKIDO-2025-10546

TL;DR

Affected versions of this package are vulnerable to Path Traversal via getAssetPath due to inadequate sanitization of user-controlled GET parameters passed to getAssetPath calls during frontend asset rendering. Attackers can exploit this by manipulating input fields to inject directory traversal sequences, tricking the system into accessing or exposing files outside the intended asset directory. Successful exploitation allows unauthorized reading of sensitive server files, potentially leading to information disclosure, authentication bypass, or server compromise.