GHSA-CFQX-F43M-VFH7 @saltcorn/server arbitrary file and directory listing when accessing build mobile app results

Summary A user with admin permission can read arbitrary file and directory names on the filesystem by calling the admin/build-mobile-app/result?builddirname= endpoint. The builddirname parameter is not properly validated and it's then used to construct the buildDir that is read. The file/director...