ispathtrusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parentpath), without appending a path separator. A directory whose name merely begins with an allowed path therefore satisfies the comparison, so where /data/images is allowed a request for /data/imagesprivate/secret.txt is treated as trusted and served by FileResponse, disclosing files the confinement was meant to exclude. Whether the check applies depends on getenableaccesscontrol in scripts/iib/tool.py: it returns true when IIBACCESSCONTROL is set to enable, false when set to disable, and otherwise true when the host Stable Diffusion WebUI was started with share, ngrok, listen or servername, falling back to false. Confinement is therefore active in the network-exposed WebUI deployments that rely on it, while a standalone run with no such option serves every readable file regardless of this flaw. The fix compares against parentpath joined with os.sep.