CVE-2019-17572

CVE-2019-17572 affects Apache RocketMQ from versions 4.2.0 through 4.6.0. When broker automatic topic creation is enabled by default, an attacker-provided topic such as “../../../../topic2020” can cause a directory to be created in the broker’s parent directory, resulting in a directory traversal...