AIKIDO-2026-10283

TL;DR

Affected versions of this package are vulnerable to a path traversal vulnerability that allowed directory escape via GraphQL filesystem bridge operations due to insufficient validation of resolved paths against a trusted base directory. An attacker could exploit this by supplying crafted file paths (including percent-encoded traversal payloads such as ..%2f..%2f) to media upload, delete, list, or filesystem get/put/glob routes, potentially reading, overwriting, or deleting arbitrary files outside the intended project scope, leading to unauthorized data exposure or integrity compromise.