CVE-2016-15017: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2023-01-10T15:15Z
Repository: https://github.com/fabarea/media_upload
Language: PHP
Files changed: Classes/Service/UploadFileService.php
Commit date: 2016-07-24 19:31:39 +0200
Commit message: [SECURITY] Prevent directory traversal

Resolves #6

Diff: diff --git a/Classes/Service/UploadFileService.php b/Classes/Service/UploadFileService.php
index 0de4269..9cffba5 100644
--- a/Classes/Service/UploadFileService.php
+++ b/Classes/Service/UploadFileService.php
@@ -32,37 +32,39 @@ class UploadFileService
 
     /**
      * Return an array of uploaded files, done in a previous step.
      *
      * @param string $property
-     * @throws \Exception
      * @return UploadedFile[]
+     * @throws \InvalidArgumentException
+     * @throws \RuntimeException
      */
     public function getUploadedFiles($property = '')
     {
-
         $files = array();
         $uploadedFiles = GeneralUtility::trimExplode(',', $this->getUploadedFileList($property), TRUE);
 
         // Convert uploaded files into array
         foreach ($uploadedFiles as $uploadedFileName) {
 
-            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . '/' . $uploadedFileName;
+            // Protection against directory traversal
+            $uploadedFileName = str_replace('..' . DIRECTORY_SEPARATOR, '', $uploadedFileName);
+            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . DIRECTORY_SEPARATOR . $uploadedFileName;
 
             if (!file_exists($temporaryFileNameAndPath)) {
                 $message = sprintf(
                     'I could not find file "%s". Something went wrong during the upload? Or is it some cache effect?',
                     $temporaryFileNameAndPath
                 );
-                throw new \Exception($message, 1389550006);
+                throw new \RuntimeException($message, 1389550006);
             }
             $fileSize = round(filesize($temporaryFileNameAndPath) / 1000);
 
             /** @var UploadedFile $uploadedFile */
             $uploadedFile = GeneralUtility::makeInstance(UploadedFile::class);
             $uploadedFile->setTemporaryFileNameAndPath($temporaryFileNameAndPath)
-                ->setFileName($uploadedFileName)
+                ->setFileName(basename($uploadedFileName))
                 ->setSize($fileSize);
 
             $files[] = $uploadedFile;
         }
 

Vulnerable code:      * @throws \Exception

            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . '/' . $uploadedFileName;
                throw new \Exception($message, 1389550006);
                ->setFileName($uploadedFileName)
Fixed code:      * @throws \InvalidArgumentException
     * @throws \RuntimeException
            // Protection against directory traversal
            $uploadedFileName = str_replace('..' . DIRECTORY_SEPARATOR, '', $uploadedFileName);
            $temporaryFileNameAndPath = UploadManager::UPLOAD_FOLDER . DIRECTORY_SEPARATOR . $uploadedFileName;
                throw new \RuntimeException($message, 1389550006);
                ->setFileName(basename($uploadedFileName))