[HIGH] Open redirect via path manipulation

PKSA-mgc1-rk7x-fh44 CVE-2016-3164 GHSA-836p-6p4j-35cg

Affected package: drupal/drupal

Affected version: >=8.0,<8.0.4

Reported by:
FriendsOfPHP/security-advisories, GitHub