Vulnerability on Everything HTTP server (directory traversal)

[Silver]

Everything version 1.5.0.1345a

A critical vulnerability exists when using the Everything HTTP server.

The web server allows directory traversal. (Web Server Directory Traversal Arbitrary File Access)
Example: [EverythingURL]/%80../%80../%80../%80../%80../%80../windows/win.ini (Access allowed)

[void]

Thank you for the security issue report Silver,

Everything-1.4.1.1023 and Everything 1.5.0.1346a fixes an issue with Everything ignoring the invalid %80 character.

[Silver]

Thank you for the quick response to the request. Unfortunately, this did not completely solve the problem.

It is still possible to get access via other characters. Example:
[EverythingURL]/%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./%c0.%c0./windows/win.ini

[void]

Thank you for the security issue report Silver,

Everything-1.4.1.1024 and Everything 1.5.0.1347a fixes an issue with utf8 => wchar injected relative paths.