TYPO3 Core

When rendering an "IMAGE" content object according to layoutKey 'picture'), paths to the rendered image sources are prefixed with the "Environment:getPublicPath()" value, resulting in corrupt image paths in the frontend.

How to reproduce
TypoScript setup:

lib.renderedImage = IMAGE
lib.renderedImage {
    file = fileadmin/testimage.jpg
    file {
        maxW = 800
        maxH = 800
    }

    layoutKey = picture

    layout {
        picture {
            element = <picture>###SOURCECOLLECTION###<img src="###SRC###" ###PARAMS### ###ALTPARAMS### ###SELFCLOSINGTAGSLASH###></picture>
            source = <source srcset="###SRC###" media="###MEDIAQUERY###" ###SELFCLOSINGTAGSLASH###>
        }
    }

    sourceCollection {
        landscape-large {
            mediaQuery = (min-width: 1800px) and (orientation:landscape)
            width = 2000c
            height = 1000c
        }
        portrait-large {
            mediaQuery = (min-height: 1800px) and (orientation:portrait)
            width = 1000c
            height = 2000c
        }
        landscape-medium {
            mediaQuery = (min-width: 1000px) and (orientation:landscape)
            width = 1200c
            height = 800c
        }
        portrait-medium {
            mediaQuery = (min-height: 1000px) and (orientation:portrait)
            width = 800c
            height = 1200c
        }
    }
}

This results in the following output (note the additional paths prepended to each "srcset" attribute):

<picture>
  <source srcset="/home/app/source/web//fileadmin/_processed_/0/b/csm_testimage_f41a083527.jpg" media="(min-width: 1800px) and (orientation:landscape)">
  <source srcset="/home/app/source/web//fileadmin/_processed_/0/b/csm_testimage_0ca3f7597f.jpg" media="(min-height: 1800px) and (orientation:portrait)">
  <source srcset="/home/app/source/web//fileadmin/_processed_/0/b/csm_testimage_276dc20341.jpg" media="(min-width: 1000px) and (orientation:landscape)">
  <source srcset="/home/app/source/web//fileadmin/_processed_/0/b/csm_testimage_9b57637f4e.jpg" media="(min-height: 1000px) and (orientation:portrait)">
  <img src="/fileadmin/_processed_/0/b/csm_testimage_e3e75227ae.jpg" alt="">
</picture>

"/home/app/source/web/" is the local path to the document root directory in my container.

Analysis/Solution
As far as I can tell, changes applied to solve #95379 did apply "PathUtility::stripPathSitePrefix()" in most cases, which is why the default image's path (above) does not have the extra path prepended. However the change probably missed stripping the path in one location: https://github.com/TYPO3-CMS/frontend/blob/main/Classes/ContentObject/ImageContentObject.php#L224 leading to the corrupted output.
Instead of

$sourceConfiguration['src'] = htmlspecialchars($urlPrefix . $sourceInfo[3]);

this line should probably read

$sourceConfiguration['src'] = htmlspecialchars($urlPrefix . PathUtility::stripPathSitePrefix($sourceInfo[3]));

as $this->cObj->getImgResource()[3] (which the above $sourceInfo³ resolves to) now always contains the document root prefix, according to the current source code and #95379.