Prevent traversing out of the uploads directory

short-pixel-optimizer / enable-media-replace

Enable Media Replace WordPress plugin

GNU General Public License v2.0

20 stars 27 forks source link

Prevent traversing out of the uploads directory #82

Closed soulseekah closed 2 years ago

soulseekah commented 2 years ago

This patch makes traversal impossible by making sure that the canonical resolved path is still inside the WordPress uploads directory. While a low-impact issue, it's still possible to do some really weird things.

pdobrescu commented 2 years ago

Thanks for the PR @soulseekah, I'll get this merged and it will be included in the next EMR release ;-)