Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library func…

A path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows malicious websites to write arbitrary files to the filesystem. When scraping websites that return filenames containing ../ sequences, attackers can control both destination paths and file content. This can lead to remote code execution through cron jobs, SSH authorized_keys, shell profiles, or web shells. The vulnerability affects versions prior to 2.0.0-alpha.4 and has been fixed in that release.