Threats tagged 'ghsa-8gmh-2hhj-2hv9'

Addressable versions from 2.2.5 up to but not including 2.9.1 contain a URI normalization flaw where paths with multiple '..' segments are incorrectly resolved. This causes some paths to normalize differently than specified by RFC 3986, potentially allowing path traversal bypasses of allowlist checks. The issue is fixed in version 2.9.1.