🚨 CVE-2026-66381
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.