Koji's SCM URL parser normalizes repository paths using urllib.parse.urlparse and os.path.normpath before evaluating them against the configured SCM policy. Because normpath decodes percent-encoded sequences at policy-check time but the underlying Git HTTP transport decodes them again during fetch, an attacker can craft a URL containing %2e%2e path traversal sequences (e.g., /rpms/%2e%2e/forks/<attacker>/rpms/<pkg>.git) that satisfies the /rpms/* policy pattern but resolves to an attacker-controlled fork repository. This allows any authenticated Koji user, without packager privileges, to submit builds sourced from attacker-controlled code. The fix normalizes and URL-decodes SCM paths before policy evaluation. The original normpath logic was introduced to address CVE-2017-1002153; this vulnerability represents a bypass of that fix.