api/get-browser-snapshot can get any file in the filesystem

[Polygons1]

the endpoint api/get-browser-snapshot can send back any file in the system and this isn't really good...

[Polygons1]

even Synk complains that there are 3 endpoints with the Path Traversal vulnerability ( api/get-browser-snapshot, api/download-project, api/download-project-pdf )

[ItsNeil17]

Yup this is quite a big vulnerability, if the contents of the files are also visible that would be really bad. Looking forward to a fix for this ^

[mufeedvh]

This app is intended to be functional on a local machine and not hosted on the Internet, but this should nevertheless be handled correctly. Will fix the LFI, thanks for raising the issue! 🙌