Yuki-Matsuhashi

An unauthenticated attacker can bypass path-based filtering because the `allowedPath` callback is evaluated before the normalization of dot segments and duplicate path separators in the pathname used for file resolution. By requesting non-canonical pathnames, such as `//file`, `/./file`, or `/public/../private/file`, an attacker can access files that were intended to be denied. This issue defeats the security boundary established by `allowedPath` but does not allow access outside the configured static root.

A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads.

Path traversal occurs when directory listing is enabled via the `list` option. The `dirList.path()` function resolves directories outside the configured static root using `path.join()` without a containment check. A remote unauthenticated attacker can obtain directory listings for arbitrary directories accessible to the Node.js process, disclosing directory and file names, although file contents are not disclosed.