AIKIDO-2026-10135

TL;DR

Affected versions of this package fail to properly validate path parameters (such as block_id, page_id, or database_id), allowing path traversal sequences like .. and URL-encoded variants (%2e%2e, mixed-case, or fully encoded paths) to be processed, which could alter the resolved API endpoint. An attacker could exploit this vulnerability by crafting malicious requests with encoded traversal payloads in path parameters to access unintended routes, bypass authorization checks, or interact with internal endpoints that should not be exposed.