GHSA-w8j7-39hp-8x59

### Summary Cloudreve trusts file paths returned by the configured remote downloader. A downloader-reported path such as `../../escaped.txt` can cause a downloaded file to be created outside the user-selected destination directory. ### Details In the remote download master transfer path, Cloudreve joins the user-selected destination URI with the downloader-reported file name. ```go // pkg/filemanager/workflows/remote_download.go:436-438 sanitizedName := sanitizeFileName(file.Name) dst := dstUri.JoinRaw(sanitizedName) src := filepath.FromSlash(path.Join(m.state.Status.SavePath, file.Name)) ``` The same issue also exists when constructing slave upload payloads. ```go // pkg/filemanager/workflows/remote_download.go:323-327 dst := dstUri.JoinRaw(sanitizeFileName(f.Name)) src := path.Join(m.state.Status.SavePath, f.Name) payload.Files = append(payload.Files, SlaveUploadEntity{ Src: src, Uri: dst, ``` The sanitizer does not remove `/`, `.`, or `..` path segments. ```go // pkg/filemanager/workflows/remote_download.go:648-650 func sanitizeFileName(name string) string { r := strings.NewReplacer("\\", "_", ":", "_", "*", "_", "?", "_", "\"", "_", "<", "_", ">", "_", "|", "_") return r.Replace(name) } ``` `JoinRaw()` splits the raw string by `/` and joins the segments, allowing `..` to affect the final URI path. ```go // pkg/filemanager/fs/uri.go:173-175 func (u *URI) JoinRaw(elem string) *URI { return u.Join(strings.Split(strings.TrimPrefix(elem, Separator), Separator)...) } ``` For aria2, Cloudreve derives `downloader.TaskFile.Name` from the path returned by `aria2.tellStatus().files[].path`. ```go // pkg/downloader/aria2/aria2.go:148-159 relPath := strings.TrimPrefix(filepath.ToSlash(item.Path), savePath) if len(relPath) > 0 { relPath = relPath[1:] } return downloader.TaskFile{ Index: index, Name: relPath, ``` Therefore, if the selected destination is: `cloudreve://my/victim/safe`, the downloader reports `../../escaped.txt`, the final upload