The default local adapter permits path traversal through collection names or retained document _id values, escaping its intended .tile database directory. No exfiltration or install-time behavior was found.
Static reason
No blocking static signals were detected.
Trigger
Application creates, updates, reads, or deletes records using attacker-influenced collection names or _id values.
Impact
Potential arbitrary user-permission BSON-suffixed file write, read, or deletion outside the database directory.
Mechanism
Unvalidated path joining for local BSON storage.
Rationale
Source inspection found a concrete path traversal in the default storage adapter, but no malicious lifecycle, network, credential, or persistence chain. Warn so consumers can assess exposure where IDs or collection names are externally controlled.
Evidence
dist/adapters/default/index.jsdist/core/collection.jsdist/adapters/default/bson.jspackage.json