01Finding and impact
An archive operation in private research automation constructed its destination using an untrusted proposal identifier. In the demonstrated vulnerable revision, a crafted identifier caused the process to overwrite a test-owned file outside the intended archive. The affected boundary was containment of proposal input within its assigned archive.
Input must reach the proposal-ingestion path, and effects are bounded by the process's filesystem permissions. The comparison does not establish an internet-facing ingress, privilege escalation, exfiltration or an affected public deployment.
02Corrective change
The recorded repair assigns sequence identifiers internally, sanitizes identifiers, verifies resolved-path containment and refuses an existing archive destination. An affected copy should incorporate that repair or equivalent containment controls and validate the actual deployment environment.
Archive-before-append and attempted restoration improve error handling. They do not establish crash-atomic behavior or protection against every concurrent filesystem race.
03Recorded comparisons
A later shell driver invoked the existing drain interface in separate, unchanged copies of each source revision. Each source received a benign control and a traversal input in different disposable directories. The target sentinel belonged to the test and remained inside its owned directory, outside the copied archive.
| Source copy | Benign input | Traversal input |
|---|---|---|
| Pre-repair | Sentinel preserved | Sentinel overwritten outside archive |
| Repair | Sentinel preserved | Sentinel preserved; identifier sanitized |
| Pinned later source | Sentinel preserved | Sentinel preserved; identifier sanitized |
All six invocations recorded exit status 0. The public JSON retains the before-and-after sentinel hashes: only the pre-repair traversal changed its target bytes. Exit status alone would have missed the problem.
The current path suite passed 14/14 checks on the pinned later source. The same fixture on the pre-repair source passed 11 and failed 3 checks. Its sentinel assertion also passed on the pre-repair source, so the suite comparison alone was insufficient to demonstrate the overwrite. The separate direct probe supplies that contrast.
04Source identity and evidence
- Pre-repair
- 8a1bfcfd5ebac049310f60fa5b3a08be5693ccac
- Repair
- c25c9d27e31ba92b293572bf7af76ee7ceaf50e2
- Later revision
- c109f4e439aa52b50ce6fd2183d04a8e7202ee5a
The documented hardening record is dated 24 June 2026. The later validation packet was prepared on 31 October 2026 UTC. Neither date is asserted as the first discovery date. The full affected-version range has not been established.
Download the observation summary (JSON), its method and source-availability note, and SHA-256 checksums. The summary is a curated extraction of recorded results. The source and original logs remain private; these downloads are not a complete public reproducer. Hashes identify bytes, not independent validation.
Work directed by Nayte Wilson, with AI assistance. Both advisories document one hardening effort in software operated by MacBrains Labs. The public ANE dataset and its DOI cover separate measurement summaries.