openhole-server vulnerable to path traversal via URL-decoded request path
openhole-server forwarded the URL-decoded request path (r.URL.Path) to tunnel clients instead of the original request-target. Percent-encoded dot-segments (%2e) and separators (%2f) were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but percent-encoded traversal sequences bypassed this and were delivered to backends as working path traversal.