Directory enumeration via traversal path oracle

Information disclosure in FreshRSS before 1.26.2 allows remote attackers to enumerate server directories through crafted ext.php requests. The endpoint resolves attacker-controlled f paths containing dot-dot segments and returns either a file body or a distinct error, creating a directory-existence oracle. The request itself requires no authentication or user interaction, but the published proof of concept needs a known readable extension asset and, for arbitrary directories, the full installation path; the result reveals directory presence rather than arbitrary file contents.