zach-d-films

This is a browser-based screenshot/video rendering utility, with no evident malware or credential theft. Its HTTP server serves decoded request paths without enforcing that files remain under ROOT, creating a path-traversal file disclosure risk if the server is reachable by an untrusted party; it also writes to caller-selected output paths. Severity is moderate and depends on network reachability and who controls requests and arguments.