From 42f2a41dd55d826e09d9ba43ae5a33578305da22 Mon Sep 17 00:00:00 2001
From: k <k@klabz.org>
Date: Tue, 7 Jul 2026 21:35:01 +0200
Subject: [PATCH] Fix symlinks in LocalFileSystem

---
 hxd/fs/LocalFileSystem.hx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hxd/fs/LocalFileSystem.hx b/hxd/fs/LocalFileSystem.hx
index 8c86fc482a..0cd46b8be2 100644
--- a/hxd/fs/LocalFileSystem.hx
+++ b/hxd/fs/LocalFileSystem.hx
@@ -375,7 +375,8 @@ class LocalFileSystem implements FileSystem {
 		return true;
 	}
 	function checkPath(path: String) {
-		if (StringTools.contains(path, "../"))
+		// fullPath() resolves symlinks; a target outside baseDir can only get the leaf check
+		if (StringTools.contains(path, "../") || !StringTools.startsWith(path, baseDir))
 			return checkPathLeaf(path);
 		var relPath = path.substr(baseDir.length);
 		var split = relPath.split("/");