AIKIDO-2025-10502

TL;DR

Affected versions of this package are vulnerable to a Path Traversal via prefix bypass, where insufficient path validation occurs when the base directory is defined, allowing malicious inputs that share an initial substring with the target directory. It happens because the sanitization logic fails to distinguish between the exact base directory and user-supplied paths containing the same prefix, treating them as valid. An attacker can exploit this by crafting paths that combine directory traversal sequences (../) with deceptive prefixes matching the start of the base directory name, thereby bypassing security checks to access arbitrary files outside the restricted directory, leading to unauthorized information disclosure or system compromise.