fix: prevent appconfig path traversal to RCE via public_/remote_ keys - #41803

Merged

oc-tmueller merged 3 commits into

10.16from

fix/oc10-146-appconfig-path-traversal

Sep 23, 2026

Commits on Sep 2, 2026

fix: prevent appconfig path traversal to RCE via public_/remote_ keys (OC10-146)

oc-tmueller
and
claude
committed
261457a

Commits on Sep 22, 2026

fix: contain public_/remote_ handler includes to the app directory

oc-tmueller
and
claude
committed
89b29d6

Commits on Sep 23, 2026

fix: guard the appconfig service-handler keys on the read path too

oc-tmueller
and
claude
committed
1d871b8