All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby are vulnerable to Directory Traversal via two separate vectors.

Affected: Maven: io.jooby:jooby, Maven: org.jooby:jooby

### Impact Access to sensitive information available from classpath.

### Patches Patched version: 1.6.7 and 2.8.2

Commit 1.x: https://github.com/jooby-project/jooby/commit/34f526028e6cd0652125baa33936ffb6a8a4a009

Commit 2.x: https://github.com/jooby-project/jooby/commit/c81479de67036993f406ccdec23990b44b0bec32

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References

Latest 1.x version: 1.6.6

#### Arbitrary class path resource access 1 When sharing a *File System* directory as in:

``` java assets("/static/**", Paths.get("static")); ```

The class path is also searched for the file (`org.jooby.handlers.AssetHandler.loader`): [jooby/AssetHandler.java at 1.x · jooby-project/jooby · GitHub](https://github.com/jooby-project/jooby/blob/1.x/jooby/src/main/java/org/jooby/handlers/AssetHandler.java)

``` java private static Loader loader(final Path basedir, final ClassLoader classloader) { if (Files.exists(basedir)) { return name -> { Path path = basedir.resolve(name).normalize(); if (Files.exists(path) && path.startsWith(basedir)) { try { return path.toUri().toURL(); } catch (MalformedURLException x) { // shh } } return classloader.getResource(name); }; } return classloader::getResource; } ```

If we send `/static/WEB-INF/web.xml` it will fail to load it from the file system but will go into `classloader.g…