AIKIDO-2026-587816

TL;DR

get_local_download_paths() and get_local_upload_paths() in _local_folder.py map Hub filenames into a caller-supplied local_dir after only a Windows-only ..\ string check, with no rejection of absolute, drive-relative, root-relative, or UNC names. On Windows, joining an anchored filename discards the destination root, so a malicious repository can write outside the intended directory or trigger an SMB connection that leaks a NetNTLMv2 hash. Separately, Sandbox.create injects the caller's HF token as SBX_DL_TOKEN into the job environment to download sbx-server, even when forward_hf_token=False, so a hostile sandbox image can read the credential before the bootstrap unsets it. The fix validates filenames with a shared _validate_relative_filename() helper on all platforms and downloads sbx-server anonymously so no HF token enters the job unless the caller opts in with forward_hf_token=True.