equanimity path traversal vulnerability

equanimity is a world-building game by A. F. Dudley, a solo developer with an emphasis on squad-based turn-based combat and balance. equanimity 2014-04-23 and earlier versions are vulnerable to a path traversal vulnerability that stems from a failure of Flask’s send_file function to properly filter special elements in resource or file paths. An attacker could use this vulnerability to access arbitrary files and directories stored on the file system.