A security researcher discovered a high-severity directory traversal vulnerability in Flask-Admin's FileAdmin component by reviewing source code. The flaw stems from using Python's startswith() string method to validate filesystem paths — a check that fails when sibling directories share a common prefix (e.g., /data/uploads and /data/uploads_secret). All FileAdmin operations (download, upload, rename, delete, create directory) relied on this flawed is_in_folder() check, meaning the configured root directory boundary could be bypassed entirely. The researcher confirmed the bug with a local test environment using curl --path-as-is, documented it, and submitted via GitHub Security Advisories — only to find it had already been reported as a duplicate.
