AIKIDO-2026-10971

TL;DR

Prefect's LocalFileSystem block is meant to confine reads and writes to a configured basepath, but _resolve_path only enforced that boundary when callers passed an internal validate flag that most public methods left disabled. Paths such as absolute locations outside the sandbox or parent-relative segments like ../escape could therefore be used for read_path, write_path, and directory copy operations. An actor who can supply filesystem paths to those APIs may read or write files outside the intended directory. The patch always resolves paths and rejects any resolved location outside basepath for every public method.