AIKIDO-2025-10557

TL;DR

Affected versions of this package are vulnerable to Path Traversal in UI Asset Handling, where insufficient input sanitization allows remote attackers to access arbitrary files outside the web root by crafting malicious URLs containing directory traversal sequences (e.g., ../). An attacker could exploit this vulnerability by manipulating the r.URL.Path parameter to bypass intended directory restrictions, for example, requesting https://target/%2e%2e/etc/passwd would traverse outside the UI asset directory.