Directory Traversal

github.com/cortexproject/cortex is vulnerable to Directory Traversal. An attacker can pass a malicious pathname such as ae ../../sensitive/path/in/deployment because it directly uses header value X-Scope-OrgID to construct file paths, leading to parsing of a rules file at that location and leakin...