Where

pageindex/tree_optimize.py:1108-1116

json.dump(refined, open(out_path, "w"), indent=2, ensure_ascii=False)
...
json.dump({...}, open(args.log, "w"), indent=2, ensure_ascii=False)

out_path = Path(args.optimized) and args.log come straight from the CLI. There is no path validation, no normalization, no allow-list.

Impact

python -m pageindex.tree_optimize --optimized /etc/cron.daily/x.json ... writes the optimized tree there. Same for --log. The script runs in the user's process, so a malicious or careless CLI invocation can overwrite any file the user can write — /etc/cron.daily/*, ~/.ssh/authorized_keys, ~/.bashrc, anything.

The script is invoked by hand and from the tests/ fixtures, so the threat model is "operator typo or compromised docs" rather than remote attacker, but the same code path is reachable from the Python SDK and from any wrapper that forwards the user's args.

Suggested fix

• Resolve args.optimized and args.log relative to an explicit base directory (e.g. the script's own output dir, or os.getcwd()), not as absolute paths the user supplies.
• Or validate the resolved path is under a known prefix and reject traversal (.., absolute paths outside the base).
• Or use argparse.FileType("w") and let argparse handle the open safely.

Reproduction

cd /tmp
echo canary > /tmp/canary.txt
python -m pageindex.tree_optimize \
    --input path/to/some/tree.json \
    --optimized /tmp/canary.txt
cat /tmp/canary.txt   # tree JSON, not the canary you wrote

Severity

Medium — needs local code execution to trigger, but the failure mode (silent overwrite of any user-writable file) is bad enough to fix.