PT-2026-69243

Summary Active Record Tenanted's override of Active Storage's DiskServicepath for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences e.g. ../ is used, it could allow reading, writing, or deleting arbitra...