AIKIDO-2026-126156

TL;DR

The registry server's POST /functions/call endpoint accepts an unauthenticated, caller-controlled trajectory_path query parameter and writes request-body content to it, guarded only by a parent-directory existence check. Requests also force-enable the trajectory tracker, bypassing its off-switch, so a traversal or absolute path lets a caller overwrite any file the server process can write. Exposure widens because the registry binds to 0.0.0.0 by default, making the endpoint reachable from untrusted networks. The fix validates the resolved path with assert_resolved_path_under against the tracker base directory and drops writes that fall outside it.