AIKIDO-2026-389801

TL;DR

#each_child on S3 and SFTP paths joins the remote file name into a URL and parses it again, so ?, +, #, and % can change the resulting child path. On S3, a key such as inbox/a+b.csv?acl=public-read produces the child path inbox/a b.csv and the request parameter acl: "public-read", allowing an untrusted object name to alter later #move_to or #copy_to calls on another object. On SFTP, the same characters can produce a child path for a different file. The fix builds each child directly from the remote name without parsing it as a URL.