humanfs: Recursive copy follows symlinked files and copies data from outside the source tree
@humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll() read and copy the contents of any file readable by the process, even when that file is outside the directory being copied.