Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.
hrsale hrsale 2.0.0