AIKIDO-2026-920436

TL;DR

The reel and story building helpers in clip.py and story.py create temporary media files with tempfile.mktemp, which only returns a predictable path and does not atomically create the file. On a shared host a local attacker can pre-create a symlink at that predictable path during the window before the library opens it, redirecting the written audio or video content to an attacker-chosen file or exposing the media being processed. This time-of-check to time-of-use race can lead to local file overwrite or disclosure. The fix introduces a _make_tmp_path helper built on tempfile.mkstemp that atomically creates a uniquely named file and closes the race window.