Debian Linux Security Advisory 3241-1 – John Heasman discovered that the site plugin handling of the Elasticsearch search engine was susceptible to directory traversal.