AIKIDO-2026-590078

TL;DR

The backup component builds the on-disk destination path from the name field inside an uploaded archive's backup.json without validating it. Supplying an absolute path makes Python's pathlib path join discard the configured backup directory prefix, so the file is written to an attacker-chosen absolute location. During the initial onboarding window this upload endpoint is reachable without authentication, and when the process runs as root the write can target sensitive files anywhere on the host, enabling remote code execution. The fix rejects unsafe inner backup.json names and adds a containment check that prevents writes outside the backup directory.