CVE-2014-3744: Directory Traversal in st

The vulnerability stems from improper path sanitization when handling URL-encoded characters. The advisory explicitly states that pre-0.2.5 versions didn't replace URL-encoded '../' sequences (%2e%2e%2f). The core path resolution logic in st.js would be responsible for decoding URLs and preventing traversal. The fix in 0.2.5 specifically addresses this by replacing all '/../' patterns regardless of encoding, indicating the path processing function was the vulnerable component. Though exact function names aren't visible in provided resources, the path resolution mechanism is clearly implicated by the nature of the vulnerability and the described fix.