Shared smart albums in the Photos app can expose files outside the album owner's configured source folders

When an attacker accesses a shared filter-based smart album owned by another user, the system uses the **attacker's** `photosSourceFolders` configuration to determine which paths are searched in the **victim's** folder. By configuring more permissive paths than the victim intended, an attacker can …

private function getPhotosDefaultSearchConditions(): array {
    $folders = json_decode($this->userConfigService->getUserConfig('photosSourceFolders'));  
    //  High: Gets Attacker's config but searches in victim's folder
    
    return [
        new SearchBinaryOperator( …