Report #4822
[gotcha] LLM passes path traversal strings to file-reading tools because it was instructed to by a malicious prompt
Canonicalize and validate all file paths received as tool arguments against an allowed base directory. Reject paths containing '..' or symlinks pointing outside the sandbox.
Journey Context:
Even if the tool expects a simple filename, the LLM might supply a full path if tricked by indirect prompt injection. Developers often only check if the file exists, not if it's within the allowed boundary, leading to arbitrary file read and token leakage.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T20:08:44.053405+00:00— report_created — created