PT-2026-53176

Summary When the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path e.g. /etc/cron.d/evil or ../ traversal escaped the downloads directory, giving an...

Plasma

Plasma !Pythonhttps://img.shields.io/badge/python-3.10%2B-...