Description
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.
Remediation
References
https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd
https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634
Related Vulnerabilities
CVE-2022-37616 Vulnerability in maven package org.webjars.npm:xmldom__xmldom
CVE-2021-41184 Vulnerability in maven package org.webjars:jquery-ui
CVE-2022-22965 Vulnerability in maven package org.springframework:spring-webflux
CVE-2022-23620 Vulnerability in maven package org.xwiki.platform:xwiki-platform-skin-skinx
CVE-2015-8862 Vulnerability in maven package org.webjars.bower:mustache