diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index b170f91f..9252de75 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -95,6 +95,7 @@ jobs:
           -DODR_WITH_PDF2HTMLEX=ON
           -DODR_WITH_WVWARE=ON
           -DODR_WITH_LIBMAGIC=ON
+          -DODR_BUNDLE_ASSETS=ON
 
       - name: cmake
         if: runner.os == 'Windows'
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 034b1eb1..c049021f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -20,7 +20,7 @@ option(WITH_LIBMAGIC "Deprecated: `ODR_WITH_WVWARE` instead! Build with libmagic
 option(ODR_WITH_PDF2HTMLEX "Build with pdf2htmlEX" "${WITH_PDF2HTMLEX}")
 option(ODR_WITH_WVWARE "Build with wvWare" "${WITH_WVWARE}")
 option(ODR_WITH_LIBMAGIC "Build with libmagic" "${WITH_LIBMAGIC}")
-option(ODR_BUNDLE_ASSETS "Bundle assets during build and install" ON)
+option(ODR_BUNDLE_ASSETS "Bundle assets during build and install" OFF)
 
 include(GNUInstallDirs)
 
@@ -265,6 +265,30 @@ set(ODR_BUILD_ODR_DATA_PATH "${CMAKE_CURRENT_BINARY_DIR}/data")
 file(COPY "${odr.js_SOURCE_DIR}/" DESTINATION "${ODR_BUILD_ODR_DATA_PATH}")
 set(ODR_INSTALL_ODR_DATA_PATH "${CMAKE_INSTALL_DATADIR}")
 
+# Validate an injected data-file path before it is used to bundle assets.
+#
+# These paths (FONTCONFIG_DATA_PATH, POPPLER_DATA_PATH, ...) are consumed but
+# never discovered by CMake — they must be injected from outside via `-D...=`;
+# our conanfile.py bridges them from the dependency runenv. A consumer that
+# builds odrcore without that bridge left the variable empty, and
+# `file(COPY "${empty}/" ...)` degraded to `file(COPY "/" ...)`, i.e. an attempt
+# to recursively copy the whole root filesystem (see issue #599). This guard
+# fails fast with an actionable message instead of copying "/".
+#
+#   path  value of the externally-injected path variable (may be empty)
+#   name  name of that variable, for the diagnostic
+function(odr_require_data_path path name)
+    if (NOT path)
+        message(FATAL_ERROR
+                "ODR_BUNDLE_ASSETS is ON but ${name} is not set. Provide it "
+                "explicitly (e.g. -D${name}=<path>) or build through the conan "
+                "recipe, or disable bundling with -DODR_BUNDLE_ASSETS=OFF.")
+    endif ()
+    if (NOT EXISTS "${path}")
+        message(FATAL_ERROR "${name} points to a path that does not exist: '${path}'.")
+    endif ()
+endfunction()
+
 if (ODR_WITH_PDF2HTMLEX)
     find_package(pdf2htmlEX REQUIRED)
     find_package(poppler REQUIRED)
@@ -284,6 +308,10 @@ if (ODR_WITH_PDF2HTMLEX)
     )
 
     if (ODR_BUNDLE_ASSETS)
+        odr_require_data_path("${FONTCONFIG_DATA_PATH}" FONTCONFIG_DATA_PATH)
+        odr_require_data_path("${POPPLER_DATA_PATH}" POPPLER_DATA_PATH)
+        odr_require_data_path("${PDF2HTMLEX_DATA_PATH}" PDF2HTMLEX_DATA_PATH)
+
         set(ODR_BUILD_FONTCONFIG_DATA_PATH "${ODR_BUILD_ODR_DATA_PATH}/fontconfig")
         set(ODR_BUILD_POPPLER_DATA_PATH "${ODR_BUILD_ODR_DATA_PATH}/poppler")
         set(ODR_BUILD_PDF2HTMLEX_DATA_PATH "${ODR_BUILD_ODR_DATA_PATH}/pdf2htmlex")
@@ -337,6 +365,8 @@ if (ODR_WITH_LIBMAGIC)
     )
 
     if (ODR_BUNDLE_ASSETS)
+        odr_require_data_path("${LIBMAGIC_DATABASE_PATH}" LIBMAGIC_DATABASE_PATH)
+
         set(ODR_BUILD_LIBMAGIC_DATABASE_PATH "${ODR_BUILD_ODR_DATA_PATH}/magic.mgc")
 
         file(COPY_FILE "${LIBMAGIC_DATABASE_PATH}" "${ODR_BUILD_LIBMAGIC_DATABASE_PATH}")
diff --git a/conanfile.py b/conanfile.py
index ae3f2aff..99ef1627 100644
--- a/conanfile.py
+++ b/conanfile.py
@@ -20,6 +20,7 @@ class OpenDocumentCoreConan(ConanFile):
         "with_pdf2htmlEX": [True, False],
         "with_wvWare": [True, False],
         "with_libmagic": [True, False],
+        "bundle_assets": [True, False],
     }
     default_options = {
         "shared": False,
@@ -27,6 +28,7 @@ class OpenDocumentCoreConan(ConanFile):
         "with_pdf2htmlEX": True,
         "with_wvWare": True,
         "with_libmagic": True,
+        "bundle_assets": False,
     }
 
     exports_sources = ["cli/*", "cmake/*", "resources/dist/*", "src/*", "CMakeLists.txt"]
@@ -73,6 +75,7 @@ def generate(self):
         tc.variables["ODR_WITH_PDF2HTMLEX"] = self.options.get_safe("with_pdf2htmlEX", False)
         tc.variables["ODR_WITH_WVWARE"] = self.options.get_safe("with_wvWare", False)
         tc.variables["ODR_WITH_LIBMAGIC"] = self.options.get_safe("with_libmagic", False)
+        tc.variables["ODR_BUNDLE_ASSETS"] = self.options.get_safe("bundle_assets", False)
 
         # Get runenv info, exported by package_info() of dependencies
         # We need to obtain PDF2HTMLEX_DATA_DIR, POPPLER_DATA_DIR, FONTCONFIG_PATH and WVDATADIR