I suspect when this is fixed we then will get an information disclosure (full path) because the Admin url of

http://0.0.0.0:8082/administrator/index.php?option=com_media&format=json&task=api.files&path=local-0:/

gives full local path of /Users/phil/Downloads/Joomla_4.0.0-alpha3-Alpha-Full_Package/images/test

{
success: true,
message: null,
messages: null,
data: [
{
type: "dir",
name: "test",
path: "local-0:/test",
localpath: "/Users/phil/Downloads/Joomla_4.0.0-alpha3-Alpha-Full_Package/images/test",
extension: "",
size: "",
mime_type: "directory",
width: 0,
height: 0,
create_date: "2018-05-12T20:42:52+00:00",
create_date_formatted: "2018-05-12 20:42",
modified_date: "2018-05-12T20:42:52+00:00",
modified_date_formatted: "2018-05-12 20:42",
adapter: "local-0"
}
]
}```