BBUGFLARE

Public library

Cybersecurity articles

Automated coverage from researcher feeds — text + code extraction, no thumbnails. Sort by recent, popular, or trending.

GitHub Advisories35
logto-tunnel serves files outside --experience-path via path traversal

### Summary `@logto/tunnel` serves custom sign-in experience files from the `--experience-path` directory. When the tunnel service is reachable, a requester can use `../` path segments in a static asset request to read files outside that directory that the CLI process can read. ### Details The tu...

Read →

Prefer original Bugflare research? Browse writeups