AIKIDO-2026-10233

TL;DR

Affected versions of this package allow directory downloads to process blob names containing path traversal sequences, which may resolve outside the intended target directory and lead to arbitrary file overwrite. An attacker could exploit this by uploading or referencing a crafted blob with traversal paths, causing the application to write files to sensitive locations on the host filesystem during download operations, potentially enabling data corruption, privilege escalation, or remote code execution depending on the overwritten file.