AIKIDO-2026-10425

TL;DR

Affected versions of this package are vulnerable to a path traversal issue in download_many_to_path, where crafted blob names could cause files to be written outside the intended destination_directory. An attacker able to control blob names could exploit sequences like ../ to overwrite arbitrary files on the host filesystem, potentially leading to unauthorized file creation or modification. The issue is fixed by ensuring resolved download paths remain within the target directory and skipping unsafe blobs.