CAS <= 1.0.0 - Unauthenticated Arbitrary File Access
This  does not validate a path generated with user input when downloading files, allowing unauthenticated user to download arbitrary files from the server