GHSA-qqqm-5547-774x

## Summary `publicPatchHandler` in `backend/http/public.go` joins user-controlled `fromPath` and `toPath` body fields with the trusted `d.share.Path` BEFORE the downstream sanitizer runs. Because `filepath.Join` collapses `..` segments during the join, the sanitizer in `resourcePatchHandler` never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with `AllowModify=true` is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. Verified on commit 869b640 (HEAD of `main` as of 2026-05-07). ## Details In `backend/http/public.go` the public PATCH handler accepts a JSON body with `items[].fromPath` and `items[].toPath` from the client, then prepends the share path before delegating to `resourcePatchHandler`: ```go // backend/http/public.go (publicPatchHandler) for i := range req.Items { req.Items[i].FromSource = sourceName req.Items[i].FromPath = utils.JoinPathAsUnix(d.share.Path, req.Items[i].FromPath) // line 372 req.Items[i].ToSource = sourceName req.Items[i].ToPath = utils.JoinPathAsUnix(d.share.Path, req.Items[i].ToPath) // line 374 } d.Data = req status, err := resourcePatchHandler(w, r, d) ``` `utils.JoinPathAsUnix` is a thin wrapper around `filepath.Join`, which calls `filepath.Clean` and resolves `..` segments. By the time the joined path reaches `resourcePatchHandler`, every `..` from the body has been collapsed: ```go // backend/http/resource.go (resourcePatchHandler) cleanFromPath, err := utils.SanitizeUserPath(item.FromPath) // line 794 // ... cleanToPath, err := utils.SanitizeUserPath(item.ToPath) // line 800 ``` `SanitizeUserPath` (in `backend/common/utils/file.go`) checks for `..` segments after `filepat