GHSA-945r-hp2m-928m

Deleting a file mount runs rm -rf where the path is built by interpolating the mount's user-controlled filePath unquoted into a shell command executed by execAsync. filePath is stored with no shell-safe validation (z.string().optional()), so an authenticated user who can create and delete a mount on a service they own obtains arbitrary command execution in the Docker-privileged host context → root on the node.

Unlike the DB changePassword family, this sink has no running-container precondition the command runs as soon as the mount is deleted which makes it the easiest to trigger.

packages/server/src/services/mount.ts:280-295 deleteFileMount:

packages/server/src/utils/filesystem/directory.ts:38-45 removeFileOrDirectory:

The remote branch (and the sibling updateFileMount, which uses … > ${quote([fullPath])} ) correctly wrap the value with shell-quote's quote(). The local branch the default single-node install driving its own host passes fullPath straight into rm -rf ${path}.