Directory traversal

Zaver through 2020-12-15 allows directory traversal via the GET /.. substring...