GHSA-4xqp-vfh8-4fv7

The workspace create handler reads body.file.path directly from untrusted JSON, because the Joi validator uses .unknown(true) and never declares the field, then passes it to an import routine designed to receive only a server generated path. A stat on the attacker chosen path yields three distinguishable outcomes, forming a filesystem existence and type oracle. Where the target directory contains a top level db.txt, the routine additionally uploads the directory's other contents into the attacker's own object store namespace and then recursively deletes it.

packages/server/src/api/controllers/workspace.ts:663-666 assigns instanceConfig.file = { path: body.file?.path } from the request body.

Where a evidence/source-validation.txt file is present, it contains the exact cited code re-confirmed at HEAD, so the claim can be checked without cloning the repository.