WS-2026-0045

Arbitrary local file read via file:// $ref in github.com/go-openapi/spec. The default document loader used to resolve and expand $ref pointers is not sandboxed: a $ref such as file:///etc/passwd or a relative ../../secret.json is read straight off disk via os.ReadFile, so a specification from an...