staticcompressedinmemorywebsitecallback.c in Glewlwyd through 2.6.2 allows directory traversal.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29967.json"