CVE-2024-54909

GoldPanKit eva-server v4.1.0 is affected by a vulnerability in the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download. The root cause is a flaw in handling the path input for that endpoint, enabling access to files...