CVE-2025-25284: ZOO-Project Arbitrary File Read via Gdal_Translate VRT Handling

ZOO-Project's Gdal_Translate service accepts GDAL VRT (virtual format) files. A VRT describes a raster by pointing at source files, and the service passes the SourceFilename value through without checking for traversal sequences.

An unauthenticated attacker submits a VRT whose SourceFilename points at any file on the server using ../ sequences. VRT's raw data mode reads the file as bytes and converts it to a TIFF, which the service hands back. That exposes configuration files, credentials and anything else the process can read. Commit 5f155a8 fixes the issue.