diff --git a/src/filesystem/path-validation.ts b/src/filesystem/path-validation.ts
index 972e9c49d0..581c17ef9d 100644
--- a/src/filesystem/path-validation.ts
+++ b/src/filesystem/path-validation.ts
@@ -32,6 +32,18 @@ export function isPathWithinAllowedDirectories(absolutePath: string, allowedDire
     return false;
   }
 
+  // Reject Windows Alternate Data Streams (ADS) to prevent path validation bypasses
+  if (process.platform === 'win32' || path.sep === '\\') {
+    const firstColonIndex = normalizedPath.indexOf(':');
+    if (firstColonIndex !== -1) {
+      const hasMoreThanOneColon = normalizedPath.indexOf(':', firstColonIndex + 1) !== -1;
+      const isValidDriveColon = firstColonIndex === 1 && /^[A-Za-z]$/.test(normalizedPath[0]);
+      if (hasMoreThanOneColon || !isValidDriveColon) {
+        return false;
+      }
+    }
+  }
+
   // Verify it's absolute after normalization
   if (!path.isAbsolute(normalizedPath)) {
     throw new Error('Path must be absolute after normalization');