CVE-2019-10743
Go-based archive library allows extraction of files to locations outside of the target folder with "../" path traversal sequences in filenames in a zip file, aka "Zip Slip"
CVE-2010-0467
Newsletter module allows reading arbitrary files using "../" sequences.