CVE-2019-6500 Detail finder
Current Description In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.
So you can modify the code exactly what you want it, to check for directory structure vulnerability! Then you can attack the server or someone's machine of someone victim.
- For example:
/../../../etc/passwordor another rexp
Info and explanation by OWASP
- Follow the instruction: BR