Path traversal vulnerability via symlinks and cross-drive paths #8313

Activity

1. mluckydream

   added

   bugSomething isn't workingSomething isn't working

   on Jan 14, 2026
2. github-actions

   assigned

   thdxr

   on Jan 14, 2026
3. github-actions commented on Jan 14, 2026

   

   github-actionsBot

   on Jan 14, 2026 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • An agent is able to read all filesystem outside a project directory in Plan mode #7504: An agent is able to read all filesystem outside a project directory in Plan mode

   This earlier issue documented the same Filesystem.contains() vulnerability with symlink bypass (item #3 in the table), along with several other related filesystem security issues. The current issue appears to be addressing the specific implementation details mentioned in that comprehensive security report.

   Feel free to ignore if this doesn't address your specific case.
4. thdxr commented on Mar 25, 2026

   

   thdxr

   on Mar 25, 2026

   Member

   More actions

   To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.
5. thdxr

   closed this as completedon Mar 25, 2026