Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem

const entries = (await fs.readdir(currentPath)) ?? [];
const exactMatch = entries.find((entry) => entry === requestedPart);
const equivalentMatches = exactMatch
  ? [exactMatch]
  : entries.filter(
      (entry) => unicodeMatchKey(entry) === unicodeMatchKey(requestedPart),
    );
...
if (equivalentMatches.length === 0) {
  // Nothing below this point exists yet, so there are no symlinks left to
  // resolve. ...
  return path.join(currentPath, ...relativeParts.slice(index));
}

(lib.ts#L159-L176.) For an entry that matches, the loop runs fs.realpath() and checks the result against the allowed directories. The matching is a string comparison: unicodeMatchKey (lib.ts#L100-L102) normalizes to NFC and maps Unicode spaces to U+0020 but keeps letter case. So with a symlink link -> /outside in the allowed directory, a request for LINK/a finds no entry called LINK, the function returns <allowed>/LINK/a unchecked, and on a case-insensitive file system mkdir or open resolves LINK through link.

The case-varied component does not have to be the symlink. In SUB/ln2/x, with sub/ln2 -> /outside, the walk stops at SUB and never looks at ln2, even though ln2 is spelled exactly. So a fix that checks only the first missing component is not enough.

History: before 2026.8.31 validatePath() ran fs.realpath() on the parent directory, so the OS did the case folding and LINK/a was refused. PR #4638 replaced that with the readdir walk; there, an unmatched component that was not the last one still raised "Parent directory does not exist". PR #4631 (issue #4629), merged on top of it, changed that branch to return the unchecked rest of the path so that create_directory can create nested directories. Both first shipped in 2026.8.31. The existing symlink test (refuses a new path under a symlinked directory that leaves (#4629)) uses the exact spelling only. The class is the one in GHSA-q66q-fx2p-7w4m (CVE-2025-53109): reaching files outside the allowed directories through symlinks inside them.

Suggested fix: when no entry matches by spelling, pass the requested name to fs.realpath() as it is, so the OS applies whatever case folding or aliasing the file system has, and check containment at every step. Only a name that neither resolves nor exists under lstat is treated as the start of the missing tail. A dangling symlink still fails like it does today. I have this as a patch with tests (the lib.ts change is below, the tests are in server-paths.test.ts) and can open a PR against the private fork:

diff --git a/src/filesystem/lib.ts b/src/filesystem/lib.ts
index abb6b09..0a52573 100644
--- a/src/filesystem/lib.ts
+++ b/src/filesystem/lib.ts
@@ -133,6 +133,18 @@ function respellAllowedDirectoryPrefix(
   return absolutePath;
 }
 
+// Whether a directory entry of this name exists, without following it: a
+// dangling symlink does, a name nothing was created under does not.
+async function entryExists(entryPath: string): Promise<boolean> {
+  try {
+    await fs.lstat(entryPath);
+    return true;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    throw error;
+  }
+}
+
 async function resolveUnicodeEquivalentPath(
   absolutePath: string,
   allowedDirectories: readonly string[],
@@ -168,16 +180,33 @@ async function resolveUnicodeEquivalentPath(
       throw new Error(`Ambiguous Unicode path component: ${requestedPart}`);
     }
 
-    if (equivalentMatches.length === 0) {
-      // Nothing below this point exists yet, so there are no symlinks left to
-      // resolve. currentPath is already realpath'd and inside an allowed
-      // directory; append the missing tail so create_directory can mkdir -p it.
-      return path.join(currentPath, ...relativeParts.slice(index));
-    }
-
-    currentPath = await fs.realpath(
-      path.join(currentPath, equivalentMatches[0]),
+    // An entry whose name matches by spelling is looked up by that name. When
+    // none does, the requested name is still handed to the OS as it is: on a
+    // case-insensitive file system (macOS APFS/HFS+ and Windows NTFS by
+    // default) it can name an existing entry spelled with other letter case,
+    // and that entry can be a symlink that leaves the allowed directories.
+    const candidate = path.join(
+      currentPath,
+      equivalentMatches[0] ?? requestedPart,
     );
+    try {
+      currentPath = await fs.realpath(candidate);
+    } catch (error) {
+      if (
+        equivalentMatches.length === 0 &&
+        (error as NodeJS.ErrnoException).code === "ENOENT" &&
+        !(await entryExists(candidate))
+      ) {
+        // Nothing below this point exists yet, so there are no symlinks left
+        // to resolve. currentPath is already realpath'd and inside an allowed
+        // directory; append the missing tail so create_directory can mkdir -p
+        // it.
+        return path.join(currentPath, ...relativeParts.slice(index));
+      }
+      // A dangling symlink also fails realpath with ENOENT; it is reported
+      // like any other failure rather than treated as a missing name.
+      throw error;
+    }
     if (
       !isPathWithinAllowedDirectories(
         normalizePath(currentPath),

Three of the four new tests in server-paths.test.ts skip themselves on a case-sensitive file system; the fourth checks that there a differently-cased name is just a new directory. I have not run the patch on macOS or Windows; it relies on fs.realpath() following a differently-cased symlink name there, as it does on the casefolded mount.

One related hardening note, not a separate claim: the first step of the same function, fs.realpath(allowedDirectory) (lib.ts#L151), is not checked against the allow-list. If an allowed directory itself is swapped for a symlink after the server started, new paths below it land in the symlink's target; that needs write access to the directory's parent, so I rate