@@ -271,3 +271,37 @@ test('cloudcmd: rest: pack: path traversal: to', async (t) => {
'Path /tmp/cc-outside/evil.zip beyond root /sandbox!'
'cloudcmd: rest: pack: get: path traversal'
// %2f-encoded slashes bypass URL normalisation; this is the exact PoC vector
'/api/v1/pack..%2f..%2f..%2ftmp%2fcc-outside%2fsecret.txt.tar.gz'
'cloudcmd: rest: pack: get: path traversal: error message'
// %2f-encoded slashes bypass URL normalisation; this is the exact PoC vector
'/api/v1/pack..%2f..%2f..%2ftmp%2fcc-outside%2fsecret.txt.tar.gz'
You can’t perform that action at this time.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
