AIKIDO-2026-201353

TL;DR

The finetune Gradio handlers in finetune_gradio.py build filesystem paths from a user-supplied project_name and pass it directly into os.path.join(base, project_name) without any containment check. Because os.path.join discards the base when the second argument is absolute, an attacker who submits an absolute path such as /tmp/EVIL as the project name escapes the intended checkpoint/data base directory. This lets a network-reachable caller create arbitrary directories and write fixed-name JSON files (for example setting.json) anywhere the server process can write, or overwrite such files. The fix adds a _safe_project_path() helper that rejects absolute paths, null bytes, and separators and verifies the resolved path stays within the base via realpath and a prefix check across all path-join sinks.