Cloudanix VulnDB

GHSA-h39g-6x3c-7fq9

Low · 3.8

Zio has SubFileSystem Path Confinement Bypass via Unresolved `..` Segment

CVSS

3.8

EPSS

—

Published

Apr 18, 2026

CISA due date

—

The record

`SubFileSystem` fails to confine operations to its declared sub path when the input path is `/../` (or equivalents `/../`, `/..\\`). This path passes all validation but resolves to the root of the parent filesystem, allowing directory level operations outside the intended boundary.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities