CVE-2026-54094: Afero Basepathfs Symlink Escapecve-2026-54094-afero-basepathfs-symlink-escape
`afero.NewBasePathFs` confines basic file operations but does not natively prevent symlink escapes. If an attacker can create or manipulate symlinks within this filesystem, they may execute a symlink attack to read or overwrite files outside the intended base path. Manual check-before-act validations often introduce Time-of-Check-to-Time-of-Use (TOCTOU) vuln
