Olivier Becker

The Webbox component constructs redirect URLs using user-supplied input appended to the redirect target in a 302 HTTP response. An attacker can use URL-encoded characters, such as `%2e` (representing a dot), to manipulate the URL portion following the top-level domain (TLD). This allows the redirection of users to a malicious domain if a similar registerable TLD exists. Additionally, the use of URL-encoded line feeds enables the insertion of arbitrary response headers in the server's HTTP response, a technique known as header injection.

Improper handling of attachment filenames during encrypted PDF generation allows an attacker to perform path traversal, which is a technique used to access files and directories that are stored outside the web root folder. This can result in the creation of new files outside the intended directory, potentially placing them in web-accessible locations.