Finding / omp
2026-10-13-omp-the-local-scratch-fallback-now-rejects-dot-session-ids-without-proving-a-general-session
The local scratch fallback now rejects dot session IDs without proving a general session-store traversal. The local:// temporary fallback-root sanitizer now rejects session IDs . and .. instead of allowing a path component to resolve outside that fallback session root. The inspected test supplies no artifacts directory. This supports a fallback-root containment fix, not remote exploitability or traversal of every persisted session directory.
Channel: tagged-release. Half: defect. Date: 2026-10-06 (v18.7.0).
Operator consequence: Use v18.7.0 or later for this inspected local-root fix. Keep assessments confined to that path unless caller-control and persisted-session evidence establishes a wider exposure.
Receipt
Finding metadata
Run: 2026-10-13-profile-refresh-2026-09-21_2026-10-13-frontier-v0
Finding ID: 2026-10-13-omp-the-local-scratch-fallback-now-rejects-dot-session-ids-without-proving-a-general-session
Source links
Primary links, including exact changelog lines when available.