AIKIDO-2026-444380

TL;DR

The serve_flows and serve_react static file routes build a filesystem path with os.path.join from a user-supplied URL segment and serve it after only an existence check, without confirming the resolved path stays under the static directory. A request containing ../ sequences escapes the static root and reads arbitrary files readable by the server process without authentication. This exposes sensitive deployment files such as .env files holding model-provider API keys and other secrets. The fix validates each resolved path with assert_resolved_path_under and returns 404 for paths that resolve outside the static root.