[cadence 5d460b82d951e01a] Checking only the staged file does not prevent a version-directory symlink from redirecting installation outside the versions folder. #248

Raised at install.sh:182 as medium by openai, ruled downgraded.

Claim. Checking only the staged file does not prevent a version-directory symlink from redirecting installation outside the versions folder.

Failure scenario. Pre-create versions/1.2.3 as a symlink to an unrelated writable directory that has no baley entry, then install version 1.2.3. The leaf checks all pass, mkdir -p accepts the symlinked directory, and mktemp and both moves operate in its external target. The installer writes an executable outside its intended staging tree and publishes a stable path dependent on that external directory.

Filed by Cadence. Fingerprint 5d460b82d951e01a over (file, claim).