Path traversal

[dcRUSTy]

Navigate to
http://127.0.0.1:2525/
then
http://127.0.0.1:2525/releases/v2.3.0%2f..%2f..%2f_header

Expected behaviour

Error
...

Actual behaviour

It renders /src/views/_header.ejs

...

Further Possibilities

Code Execution even without --allowInjection if malicious user knows location of malicious .ejs file on filesystem
...

Software versions used

OS         : Windows 10
mountebank : 2.3.0

Log contents in mb.log when running mb --loglevel debug

info: [mb:2525] mountebank v2.3.0 now taking orders - point your browser to http://localhost:2525/ for help
debug: [mb:2525] config: {"options":{"loglevel":"debug","port":2525,"noParse":false,"pidfile":"mb.pid","nologfile":false,"logfile":"mb.log","allowInjection":false,"localOnly":false,"ipWhitelist":["*"],"mock":false,"debug":false,"heroku":false,"protofile":"protocols.json"},"process":{"nodeVersion":"v12.18.0","architecture":"x64","platform":"win32"}}
info: [mb:2525] GET /images/book.jpg
info: [mb:2525] GET /images/book.jpg