Multiple path manipulation vulnerability

[enferas]

Hello,

I would like to report for possible path manipulation vulnerabilities.

The path of the vulnerability.

In file https://github.com/zyx0814/dzzoffice/blob/master/dzz/io/setStream.php

if(!$path=dzzdecode(rawurldecode($_GET['path']))){
    exit('Access Denied');
}
//...
if(!$msg && ($re=IO::setFileContent($path,$content,true))){
    //...
}

In file https://github.com/zyx0814/dzzoffice/blob/master/core/class/io/io_ALIOSS.php

public function setFileContent($path,$data){
    //..
              self::deleteThumb($path);
    //..
}

In file https://github.com/zyx0814/dzzoffice/blob/master/core/class/io/io_ALIOSS.php

public function deleteThumb($path){
        global $_G;
        $imgcachePath='./imgcache/';
                // Note path carry the value from the source
        $cachepath=str_replace('//','/',str_replace(':','/',$path));

        foreach($_G['setting']['thumbsize'] as $value){
            $target = $imgcachePath . ($cachepath) . '.' . $value['width'] . '_' . $value['height'] . '_1.jpeg';
            $target1 = $imgcachePath . ($cachepath) . '.' . $value['width'] . '_' . $value['height'] . '_2.jpeg';
            @unlink($_G['setting']['attachdir'].$target);
            @unlink($_G['setting']['attachdir'].$target1);
        }

    }

We see that there is no check between the input $_GET['path'] and the unlink for the $target. $target can carry the value ../ which go back in the image directory.