Threats affecting pkg:github/montferret/ferret

CVE-2026-34783 is a path traversal vulnerability in MontFerret's ferret product prior to version 2.0.0-alpha.4. The flaw exists in the IO::FS::WRITE standard library function, allowing a malicious website to cause Ferret to write arbitrary files to the host filesystem by using crafted filenames containing '.. /' sequences. This can enable attackers to control both the destination path and file content, potentially leading to remote code execution through mechanisms like cron jobs, SSH authorized_keys, shell profiles, or web shells. The vulnerability is fixed in version 2.0.0-alpha.