AIKIDO-2025-10685

TL;DR

Affected versions of this package are vulnerable to Arbitrary File Read via Path Traversal due to improper validation of the server_bundle_output_path that allows an attacker to break out of the intended directory. By exploiting this flaw, an attacker could potentially read sensitive files from anywhere on the filesystem that the application has access to, using directory traversal sequences (e.g., ../../etc/passwd) in the path configuration, leading to an information disclosure vulnerability or further exploitation.