In affected versions, "Request::buildRequestUrl()" inserts path variables into the request URL without URL encoding ("implode('/', $pathVariables)"). All request classes implementing "getPathVariables()" are affected, e.g. "GetContentDetailsRequest" ("scheme", "contentId"). If a consuming application passes untrusted input (such as an ID taken from an HTTP request parameter) as a path variable, characters like "../", "?" or "#" are sent verbatim and can change the path of the resulting API request.