2018-10-29 13:29:01 2018-12-06 18:39:14

ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.