The canto-saas-api PHP library versions before 3.0.0 improperly neutralize special elements in output used by downstream components. Specifically, Request::buildRequestUrl() joins path variables returned by Request::getPathVariables() without encoding individual segments, including scheme and contentId values used by GetContentDetailsRequest. If an attacker controls a path variable through the consuming application and that application does not validate or trust the input, they can inject path traversal or query delimiters that alter the destination endpoint before authentication tokens are attached. This can lead to unintended reads or writes on the same Canto instance with the application's privileges. The vulnerability is addressed in version 3.0.0.

An attacker who can supply untrusted path variable values through a consuming application can manipulate API request URLs to access or modify resources beyond intended scope, leveraging the application's privileges. This can result in unauthorized data exposure or modification within the same Canto instance. Applications that only use trusted and validated identifiers are not vulnerable.

Upgrade to canto-saas-api version 3.0.0 or later, where this issue is fixed by properly encoding path segments. Until upgrading, ensure that all path variable inputs are strictly validated and trusted to prevent injection of special characters that could alter request URLs.