AIKIDO-2026-256263
fsspec is vulnerable to Path Traversal
59
Medium Risk
This Affects:
fsspecTL;DR
DirFileSystem joins a caller supplied relative path onto its configured root without checking for .. segments before handing the combined path to the wrapped LocalFileSystem. A relative path with enough .. segments resolves outside the configured root, letting code that treats DirFileSystem as a sandboxed root read or write files elsewhere on the local filesystem. The fix checks the path segments and raises ValueError when the result would escape the root before the join happens.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use DirFileSystem chained onto a LocalFileSystem to expose a restricted local directory to relative paths from a less trusted caller.
Background info
fsspec is vulnerable to Path Traversal in versions 2022.2.0 - 2026.6.0.
How to fix this
Upgrade the fsspec library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.