The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-34126.json"