CVE-2020-27993

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.

Source: CVE-2020-27993