Duplicate Advisory: Model-artifact APIs bypass pathsec and touch files outside allowed roots
High severity
GitHub Reviewed
Published
Aug 27, 2026
to the GitHub Advisory Database
•
Updated Sep 2, 2026
Withdrawn
This advisory was withdrawn on Sep 2, 2026
Give feedback on Dependabot alerts