AIKIDO-2025-10767

TL;DR

Affected versions of this package are vulnerable to a path traversal attack due to insufficient input validation in destinationDir and publicBasePath parameters, where the code fails to check for path traversal sequences, block null bytes and malicious characters, and prevent directory escape while allowing absolute paths. This flaw enables attackers to craft malicious inputs that bypass intended restrictions, potentially allowing them to access or modify sensitive files outside the designated directory, leading to information disclosure or system compromise.