diff --git a/cmd/generate_changelog/incoming/2123.txt b/cmd/generate_changelog/incoming/2123.txt new file mode 100644 index 00000000..049792eb --- /dev/null +++ b/cmd/generate_changelog/incoming/2123.txt @@ -0,0 +1,3 @@ +### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup + +- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.