AIKIDO-2026-247270

TL;DR

The FileExplorer component's preprocess() method builds a path by joining a configured root directory with caller-supplied path segments using unsafe path construction. When the segments contain directory traversal sequences or absolute paths, the root prefix is discarded and the resolved path escapes the intended directory. Unauthenticated requests can therefore read arbitrary files outside the configured root, exposing sensitive files on the host. The fix routes both single and multiple selection paths through a safe-join helper that rejects out-of-root resolutions.