glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code

It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats" translator. An attacker can use this flaw to create files and execute arbitrary code. To exploit this, the attacker would require...