CVE-2021-3907

OctoRPKI does not escape a URI with a filename containing “…”, this allows
a repository to create a file, (ex.
rsync://example.org/repo/…/…/etc/cron.daily/evil.roa), which would then
be written to disk outside the base cache folder. This could allow for
remote code execution on the host machine OctoRPKI is running on.