AIKIDO-2026-11015

TL;DR

A flaw in glob-to-regex translation caused negated character classes like [!a] to be interpreted incorrectly during permission matching, silently reversing the intended allow/deny logic of affected rules. Instead of meaning any character except a, the pattern was treated as matching ! or a, which could make restrictive rules ineffective and permissive rules behave unpredictably. An attacker might exploit this by crafting file paths, resource names, or permission-matched inputs that intentionally satisfy the inverted pattern, allowing access to operations or resources that should have been blocked.