Feast Feature Server <=0.58.0 - Arbitrary File Read

Feast the open-source Feature Store Feature Server through 0.58.0 exposes an unauthenticated POST /read-document endpoint that reads an arbitrary, caller-supplied file path with no authentication and no path validation. The readdocumentendpoint handler passes the JSON filepath field straight to...