@mobfish-ai/cortex-harness-open

The `name` keys come straight from the candidate MANIFEST.json (`files`) and are never checked for `..`; join(stage, name) therefore resolves outside the staging directory. verifyIndex also uses join(dir, name), so the whole path is attacker-influenced. Someone who supplies the directory passed to `update --from` can cause files to be written outside the index (content is a readable file whose hash the attacker also declares), and those writes survive the later STAGE_INVALID cleanup. Precondition: an operator runs the CLI update against an untrusted candidate directory.

The check exists to stop traversal in the manifest identifier forwarded to the local CORTEX API, but it only splits on `/`. On Windows hosts `..\\..\\x` and drive-absolute paths such as `C:\\x` pass validation, so browser-supplied command text can hand the host-side API a path outside the intended manifest area. Impact depends on how the CORTEX server resolves the manifest, but the sanitisation the plugin advertises is bypassable on one platform class.