Path traversal in dataCycle-CORE markdown renderer (CVE-2026-32820)

The documentation and static markdown renderer in dataCycle-CORE accepts attacker-controlled path segments and processes them only through the Rails HTML sanitizer, which does not strip directory traversal sequences. An unauthenticated attacker can traverse out of the intended `docs` or `static` directories and render arbitrary `.md` files from the application root or engine root. This exposes potentially sensitive file content to unauthorized parties. Affected versions: - <= 25.07.3 We recommend updating to: 26.06.08. CVSS 7.5 · our assessment: this_week Reference: https://github.com/datacycle-engine/dataCycle-CORE/security/advisories/GHSA-gc37-6w59-hj36 Details: https://vuln.today/cve/CVE-2026-32820