[HIGH] Path traversal in phlo.yaml loading

[iamgp]

Summary

PHLO_PROJECT_PATH environment variable used without path sanitization. Attackers could set paths like /etc/ or ../../../etc/ to read arbitrary files.

Location

src/phlo/infrastructure/config.py lines 26-39

Vulnerable Code

env_path = os.environ.get("PHLO_PROJECT_PATH")
project_root = Path(env_path or ".")

Recommended Fix

Validate that the resolved path is within the project directory or user home directory. Reject paths containing .. or absolute paths outside allowed directories.

---

Severity: P1 - High
Category: Security
Audit Reference: AUDIT.md