Node-RED-Dashboard prior to 2.26.2 allows ui_base/js/..%2f directory traversal to read files.
nodered node-red-dashboard