AIKIDO-2026-10967

TL;DR

The FolderSchemeHandlerFactory custom scheme handler maps requested URLs to files under a configured rootFolder. Before the fix, path resolution and a plain string prefix check could allow traversal sequences such as encoded ../ segments to read files outside the intended directory, including similarly prefixed sibling folders. An attacker who can steer the embedded browser to crafted scheme URLs may retrieve local files that should stay outside the served root. The fix normalizes the root directory boundary, rejects dangerous path characters, and enforces containment after full path resolution.