fix: prevent path traversal in FileSystemKnowledge.get_file (#8624) - #8726

Summary

Fixes the path-traversal vulnerability in FileSystemKnowledge._get_file fixes #8624.

FileSystemKnowledge(base_dir=...) exposes a get_file tool that the agent can call. Before this change, _get_file built the target path as Path(query) if isabs else base_path / query with no containment check, so a model-driven tool call (or a relative path like ../outside_secret.txt, or an absolute path such as /etc/passwd) could read any file the process had access to.

The fix builds the path with the shared safe_join_relative_path helper and rejects anything that escapes base_dir, mirroring the pattern already used by AirflowTools and agno/skills/agent_skills.py:

try:
    file_path = safe_join_relative_path(self.base_path, query)
except PathSecurityError:
    return []

safe_join_relative_path rejects absolute paths, .. traversal that escapes the base, control characters, and Windows drive/UNC prefixes, and it resolves the target before a containment check — so symlinks inside base_dir that point outside are blocked as well.

Error handling is also tightened: _get_file no longer swallows read errors into an empty list. Genuine read failures (e.g. a file that exists but is unreadable) propagate to the get_file tool wrapper, which surfaces the real cause to the agent — the same shape AirflowTools uses:

try:
    docs = self._get_file(path)
except Exception as e:
    log_warning(f"Error reading file {path}: {str(e)}")
    return f"Error reading file {path}: {e}"

Agent-facing behaviour: files inside base_dir return their content as before; missing / not-a-file / traversal / outside paths all return the safe File not found: {path} (an escape is indistinguishable from a missing file, so nothing is disclosed); a present-but-unreadable file returns the real error.

Type of change

• Bug fix
• New feature
• Breaking change
• Improvement
• Model update
• Other:

Checklist

• Code complies with style guidelines
• Ran format/validation scripts (./scripts/format.sh and ./scripts/validate.sh) — ruff format unchanged, ruff check clean, mypy reports no errors in knowledge/filesystem.py
• Self-review completed
• Documentation updated (comments, docstrings)
• Examples and guides: Relevant cookbook examples have been included or updated (if applicable)
• Tested in clean environment
• Tests added/updated — four path-traversal regression tests in test_filesystem_knowledge.py

Duplicate and AI-Generated PR Check

• I have searched existing open pull requests and confirmed that no other PR already addresses this issue

Notes for the maintainer

• _list_files and _grep are not affected: they walk os.walk(self.base_path) and never join a user-supplied root, so no equivalent fix is required.
• The fix is intentionally narrow: the _get_file signature, the tool contract, and all other class behaviour are unchanged. Files inside base_dir continue to work exactly as before.
• The four regression tests cover relative .. traversal, an absolute path outside the base, a symlink inside the base that points outside, and the exposed get_file tool. They follow the existing test file's structure (nested base_dir under tmp_path, no manual cleanup).