{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "potato-annotation"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.4.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-08T17:31:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n`validate_path_security` uses string-prefix containment (`startswith`) for boundary checks. This allows paths that are **outside** the intended project directory but share its prefix string (e.g., `/tmp/potato_proj_demo_evil/...` vs `/tmp/potato_proj_demo`) to be accepted.\n\n## Details\n### Affected source location (root cause)\n**File:** `potato/server_utils/config_module.py`\n\n**Snippet (lines 370\u2013373):**\n```python\nreal_path = os.path.realpath(normalized_path)\nreal_base = os.path.realpath(base_dir)\nif not real_path.startswith(real_base):\n    raise ConfigSecurityError(...)\n```\n\n**Snippet (lines 384\u2013389):**\n```python\nreal_path = os.path.realpath(normalized_path)\ncheck_dir = project_dir if project_dir else base_dir\nreal_check_dir = os.path.realpath(check_dir)\nif not real_path.startswith(real_check_dir):\n    raise ConfigSecurityError(...)\n```\n\n`startswith()` is string-based, so `/tmp/potato_proj_demo_evil/...` passes when checked against `/tmp/potato_proj_demo`.\n\n### Confirmed affected call sites\n**File:** `potato/server_utils/config_module.py`\n\n1) `validate_file_paths` task_dir branch (line 2113)\n```python\nvalidated_task_dir = validate_path_security(task_dir, project_dir)\n```\n\n2) `validate_file_paths` data_files branch (line 2151)\n```python\nvalidated_path = validate_path_security(file_path, base_dir, project_dir)\n```\n\n3) `validate_training_config` training.data_file branch (line 2286)\n```python\nvalidated_path = validate_path_security(data_file, base_dir, project_dir)\n```\n\n## PoC\n```python\nfrom potato.server_utils.config_module import validate_path_security\n\nbase = \u0027/tmp/potato_proj_demo\u0027\nvuln = \u0027/tmp/potato_proj_demo_evil/file.txt\u0027\n\ntry:\n    print(\u0027inside=\u0027, validate_path_security(\u0027/tmp/potato_proj_demo/file.txt\u0027, base, base))\nexcept Exception as e:\n    print(\u0027inside_error=\u0027, type(e).__name__, e)\n\ntry:\n    validate_path_security(\u0027/tmp/other_demo/file.txt\u0027, base, base)\nexcept Exception as e:\n    print(\u0027baseline=\u0027, type(e).__name__, e)\n\nprint(\u0027trigger=\u0027, validate_path_security(vuln, base, base))\n```\n\n## Impact\n- Can allow unauthorized sibling-prefix file access outside intended project boundary.\n- Can affect read paths (`data_files`, `training.data_file`, `base_css`, `header_logo`) and output/path placement depending on configuration.",
  "id": "GHSA-q9m2-fhv9-3jcf",
  "modified": "2026-05-08T17:31:07Z",
  "published": "2026-05-08T17:31:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/davidjurgens/potato/security/advisories/GHSA-q9m2-fhv9-3jcf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/davidjurgens/potato"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "`potato-annotation` has a Project-Boundary Bypass"
}