[HIGH] Relative Path Traversal (CWE-23) in chunked uploads

PKSA-6t6b-h8d7-5sbs CVE-2020-5237 GHSA-x8wj-6m73-gfqp

Affected package: oneup/uploader-bundle

Affected version: >=1.0.0,<1.9.3|>=2.0.0,<2.1.5

Reported by:
GitHub, FriendsOfPHP/security-advisories