Vendor
Paisa versions prior to 0.7.8 contain a path traversal vulnerability in multiple API handlers, allowing unauthenticated attackers to read arbitrary files or delete backups via directory traversal sequences.