Relative Path Traversal in Flarum using fake OAuth Provider

Reported a low impact Path Traversal where an OAuth Provider could read local files exploiting relative path traversal in Flarum.

References

• https://huntr.com/bounties/1-flarum/core/