fix(security): Path Traversal (GHSA-m4hv-9p7g-56vm) (#41790)

## Description

fix(security): Path Traversal in git file read/delete operations
(GHSA-m4hv-9p7g-56vm)

- **Primary fix:** Extended `validatePathIsWithinGitRoot()` coverage
from write-only to all file operations (reads + deletes) via validated
wrapper methods in `FileUtilsCEImpl`. All 31 direct
`fileOperations.readFile/readFiles/readFileAsString` call sites now go
through path validation.
- **Defense-in-depth:** Widened `validatePathIsWithinGitRoot` visibility
from `private` to `protected` so EE subclasses can reuse it. Added
validated wrappers for `deleteFile` and `deleteDirectory` as well.
- **Test coverage:** Added 2 regression tests: one verifying path
traversal is blocked, one ensuring valid paths within git root still
work.

Fixes
https://linear.app/appsmith/issue/APP-15180/security-path-traversal-in-file-operations-fileoperationscev2impl-ghsa

### Vulnerability

| Field | Value |
|-------|-------|
| **GHSA** |
[GHSA-m4hv-9p7g-56vm](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-m4hv-9p7g-56vm)
|
| **CVE** | Not assigned |
| **CVSS** | 7.7 (high) |
| **CWE** | CWE-35 |
| **Affected component** | `FileOperationsCEv2Impl` — git file
operations |

### Exposure Analysis

- **Who can exploit this?** An authenticated user with git
connect/import permissions (Developer role or higher). The attacker
needs to create or import a malicious git repository with crafted
directory/file names containing path traversal sequences.
- **What can an attacker achieve?** Read arbitrary files from the server
filesystem, including sensitive configuration files, secrets, or user
data. The vulnerability is read-only (writes were already protected).
- **Evidence of exploitation in the wild?** No evidence of active
exploitation.
- **Blast radius:** Any self-hosted or cloud Appsmith instance with git
features enabled. The attacker can read files accessible to the Appsmith
server process, potentially affecting all workspaces on the instance.

### Fix

- **Root cause:** Asymmetric path validation — `FileUtilsCEImpl` had
`validatePathIsWithinGitRoot()` applied to all write operations
(`saveResource`, `saveActions`, etc.) but not to any read operations
(`readFile`, `readFiles`, `readFileAsString`) or delete operations
(`deleteFile`, `deleteDirectory`).
- **Fix strategy:** Created `protected` validated wrapper methods
(`readFileValidated`, `readFilesValidated`, `readFileAsStringValidated`,
`deleteFileValidated`, `deleteDirectoryValidated`) in `FileUtilsCEImpl`
that validate path containment before delegating to `fileOperations`.
Replaced all 31 direct read call sites and 8 delete call sites with the
validated wrappers.
- **Intentionally not changed:** `FileOperationsCEv2Impl` — this is the
raw I/O layer that doesn't know about git root paths. Validation belongs
in `FileUtilsCEImpl` which owns the path policy. `scanAndDelete*`
methods are also unchanged since they operate on bounded `Files.walk()`
results within an already-validated base directory.
- **Defense-in-depth:** The validation method is now `protected` so EE's
`FileUtilsImpl` (which has its own direct read calls) can inherit and
use the same wrappers.

### CE/EE sync

Shadow EE PR needed. `FileUtilsCEImpl.java` change syncs automatically
via hourly CE→EE sync. EE's `FileUtilsImpl.java` has ~8 additional
direct `fileOperations.readFile()` calls that need to be updated to use
the inherited validated wrappers in a separate EE PR.

### Disclosure

> **Do not merge until advisory is ready for disclosure coordination.**
>
> After merge:
> 1. Confirm fix is in release branch
> 2. Coordinate with security team on disclosure timeline
> 3. Update advisory with patched version and publish
> 4. Notify reporter

## Automation

/ok-to-test tags="@tag.All"

### :mag: Cypress test results
<!-- This is an auto-generated comment: Cypress test results  -->
> [!TIP]
> 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
> Workflow run:
<https://github.com/appsmithorg/appsmith/actions/runs/25638434147>
> Commit: 809c50fc293db1d933804d344bbf2d6e90b831e5
> <a
href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=25638434147&attempt=1"
target="_blank">Cypress dashboard</a>.
> Tags: `@tag.All`
> Spec:
> <hr>Sun, 10 May 2026 21:09:23 UTC
<!-- end of auto-generated comment: Cypress test results  -->

## Communication
Should the DevRel and Marketing teams inform users about this change?
- [ ] Yes
- [x] No

## Follow-ups

- Shadow EE PR for `FileUtilsImpl.java` to update EE-specific
read/delete calls to use inherited validated wrappers
- `FileOperationsCEv2Impl.saveMetadataResource()` calls its own
`saveResource()` bypassing `FileUtilsCEImpl` validation — pre-existing
gap, separate follow-up


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Enhanced security for Git repository file operations by enforcing path
boundary validation on all read and delete operations to prevent
unauthorized file access outside the configured repository.

* **Tests**
* Added regression tests validating path traversal attack prevention in
Git repository operations.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/appsmithorg/appsmith/pull/41790)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->