CVE-2026-74884: Plugin Sandbox Py Cwe 000 Cve 2026 74884cve-2026-74884-plugin-sandbox-py-cwe-000-cve-2026-74884
An attacker-influenced identifier ($IDENT) read off a data object ($OBJ: a plugin/request/tenant context, config or mapping) flows into filesystem path construction or into a startswith()/endswith() access-control prefix without validation. A value containing "/", "\", a NUL byte or ".." makes os.path.realpath()/os.path.expanduser() resolve the boundary dire
