Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.
Advisories for Maven/Fish.payara.api/Payara-Bom package
2022