PT-2026-137108

Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because...