Adeadfed

An issue was discovered in the custom implementation of a web server, available via the "zola serve" command, which allows directory traversal. The `handle request` function, used by the server to process HTTP requests, does not account for sequences of special path control characters (`../`) in the URL when serving a file, allowing one to escape the webroot of the server and read arbitrary files from the filesystem.

A dependency confusion in pipreqs allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.

The issue allows remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the `returnUrl` parameter. This parameter is processed by several functions, including the `ChangePassword` function, `SignInCustomerAsync` function, `SuccessfulAuthentication` method, or the `NopRedirectResultExecutor` class.