Description
iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.
Remediation
References
https://github.com/ioBroker/ioBroker.admin/commit/16b2b325ab47896090bc7f54b77b0a97ed74f5cd
https://snyk.io/vuln/SNYK-JS-IOBROKERADMIN-534634
Related Vulnerabilities
CVE-2016-10735 Vulnerability in maven package org.jszip.redist:bootstrap
CVE-2021-33605 Vulnerability in maven package com.vaadin:vaadin-checkbox-flow
CVE-2020-27216 Vulnerability in maven package jetty:jetty
CVE-2022-35961 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts-upgradeable
CVE-2021-32621 Vulnerability in maven package org.xwiki.platform:xwiki-platform-dashboard-macro