CVE-2026-76806 Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle

Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because...