CVE-2020-35284

CVE-2020-35284 affects Flamingo (aka FlamingoIM). The vulnerability allows directory traversal (via ../) in file-transfer requests; the issue arises because the only ostensibly unpredictable part is an MD5 computation that runs on the client side, and the computation details can be inferred from ...