AIKIDO-2026-387968

TL;DR

The page cache key is built from the request path without rejecting traversal segments, so cache file paths can escape the intended cache directory. An unauthenticated attacker can write a file into any existing directory on the server, inside or outside the web root, and overwrite whatever occupies that name. On Apache this can overwrite .htaccess files, breaking the site and removing hardening rules. The fix validates the request path used when constructing cache file names.