AIKIDO-2026-57045

TL;DR

The copy and move methods use checkParentPaths and checkParentPathsSync in lib/util/stat.js to detect when the destination is inside the source directory and abort so copy does not recurse into the tree it is creating. The check walks up the destination's ancestors but returns early when an intermediate ancestor does not yet exist, so a deeper existing ancestor that is a symlink pointing into the source tree is never inspected. An attacker who controls such a symlinked destination ancestor bypasses the self-subdirectory protection, causing copy to create the missing path under the symlink target and recurse into the source subtree until resource exhaustion or ENAMETOOLONG. The fix keeps walking up to an existing ancestor on ENOENT instead of returning early.