A path allowance check in the `isAllowedAbsPath()` function of `GeneralUtility` uses a plain string prefix comparison that does not require a directory separator boundary. This allows paths that start with the same characters as the project root but are actually different directories (e.g., `/var/www/html-other/secret.yaml` when the root is `/var/www/html`) to be accepted as valid. Administrator users with access to the File Abstraction Layer can exploit this to create new file storage definitions pointing to directories outside the project root.