AIKIDO-2026-606206

TL;DR

The SDK downloads files from S3 to the local filesystem in several helpers, including Session.download_data, _download_files_under_prefix, the MLflow model artifact downloader, and the local transform job. These helpers build each local destination path by joining the target directory with the S3 object key and write the file without checking that the resolved path stays inside the target directory. An actor who can place objects with crafted keys containing relative path segments in a downloaded S3 prefix can cause files to be written outside the intended directory, resulting in arbitrary file write. The fix adds a validate_path_within_directory helper that canonicalizes paths with os.path.realpath and rejects any destination that escapes the target directory.