Security fixes are provided for the latest released version.

Please do not open a public issue for security problems.

Report vulnerabilities privately through GitHub: Security → Report a vulnerability.

Include a description, the affected version, and a minimal program that reproduces the issue. We aim to acknowledge reports within a few business days and to release a fix or mitigation as soon as a valid issue is confirmed.

This library is a uniform API over storage. Every operation runs as ordinary .NET code with the privileges of the host process. There is no sandbox: the library decides which call to make, not what the process is allowed to touch.

FileSystem.Local reaches everything the process account can reach. A path is resolved and passed to the underlying storage; there is no root allowlist and no jail. A path assembled from untrusted input can therefore leave the directory you had in mind:

var file = FileSystem.Local.GetFile(Path.Combine(uploadDirectory, userSuppliedName));

Validate userSuppliedName yourself, or compose a restricted tree with VirtualDirectory and hand out only that.

IFileSystemPermissionsOperations is consulted by this library (FileSystem.cs, DemandReadRightsInternal / DemandWriteRightsInternal) before it performs an operation. It is not enforced by the storage. It stops calls made through this API. It does not stop anything else in the process, or any other process, from opening the same file directly.

Treat it as a policy layer for your own code, not as an access control mechanism against an attacker who can run code in the same process.

A provider that does not support direct stream access falls back to DelayWriteStream, which buffers through Path.GetTempFileName() (IO/Streams/DelayWriteStream.cs). File content therefore reaches the system temporary directory in clear form, and stays there until the stream is closed.

The temporary directory is part of the trust boundary. On a shared machine, or wherever TMP/TEMP points somewhere other processes can read, sensitive content is exposed for the duration of the transfer. Set the temporary directory accordingly, or use a provider with direct stream access.

VirtualDirectoryEntry mounts a directory of a backing file system. Everything below that directory becomes reachable through the virtual tree, including entries added later. Mount the narrowest directory that works.

Connection configuration objects hold passwords, tokens and keys in managed memory for the lifetime of the file system instance. They are not encrypted, not pinned and not zeroed on disposal, so they can appear in a process dump. Keep the file system instance no longer than needed, and source the secrets from a secret store rather than from source or configuration files.

• It does not validate or sanitize paths beyond what the target storage requires.
• It does not limit file size, operation count or transfer rate. A large SyncWith over untrusted input can exhaust disk or bandwidth.
• It does not verify content: FileHash reports what the provider returns and is not a signature.