[GHSA] GHSA-c6f4-wj38-m3g3 (high) — Snipe-IT vulnerable to directory traversal in displaySig

GHSA-c6f4-wj38-m3g3 Severity: high CVE: CVE-2026-55474

Snipe-IT vulnerable to directory traversal in displaySig

### Impact The `displaySig` action in `ActionlogController` serves signature image files from a private upload directory. The filename parameter from the HTTP route is concatenated directly into a filesystem path with no sanitization, allowing an authenticated attacker to traverse outs