Path Traversal

NATS nats-server is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check while constructing filenames for account synchronization, which happens in the system account, allowing arbitrary file write as the user running NATS by anyone who can publish arbitrary messages to the system account. This can lead to an unexpected write to an arbitrary file or a lateral movement by an attacker within a cluster or super-cluster as the system account is shared within such a deployment.