CVE-2022-38794

Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.