CVE-2020-11455: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 9.8
Published: 2020-04-01T16:15Z
Repository: https://github.com/LimeSurvey/LimeSurvey
Language: PHP
Files changed: application/controllers/admin/LimeSurveyFileManager.php
Commit date: 2020-03-24 11:07:45 +0100
Commit message: Fixed issue [security] #16018: Path Traversal Vulnerability (Matthew Aberegg, Michael Burkey)

Diff: diff --git a/application/controllers/admin/LimeSurveyFileManager.php b/application/controllers/admin/LimeSurveyFileManager.php
index 3d3116bcf54..17c6b9d0607 100644
--- a/application/controllers/admin/LimeSurveyFileManager.php
+++ b/application/controllers/admin/LimeSurveyFileManager.php
@@ -378,34 +378,31 @@ class LimeSurveyFileManager extends Survey_Common_Action
         $arrayOfFiles = array_map( function($file){ return $file['path']; }, $files);
         $archive = new PclZip($zipfile);
         $checkFileCreate = $archive->create($arrayOfFiles, PCLZIP_OPT_REMOVE_ALL_PATH);
         $urlFormat = Yii::app()->getUrlManager()->getUrlFormat();
         $getFileLink = Yii::app()->createUrl('admin/filemanager/sa/getZipFile');
-        if($urlFormat == 'path') {
-            $getFileLink .= '?path='.$zipfile;
-        } else {
-            $getFileLink .= '&path='.$zipfile;
-        }
+        $_SESSION['__path'] = $zipfile;
 
         $this->_printJsonResponse(
             [
                 'success' => true,
                 'message' => sprintf(gT("Files are ready for download in archive %s."), $randomizedFileName),
                 'downloadLink' => $getFileLink ,
             ]
         );
     }
 
-    public function getZipFile($path) {
+    /**
+     * @return void
+     */
+    public function getZipFile()
+    {
+        $path = $_SESSION['__path'];
+        unset($_SESSION['__path']);
         $filename = basename($path);
 
-        // echo "<pre>";
-        // echo $path."\n";
-        // echo $filename."\n";
-        // echo "isFile => ".is_file($path) ? 'isFile' : 'isNoFile'."\n";
-        // echo "</pre>";
-        if (is_file($path) || true) {
+        if (is_file($path)) {
             // Send the file for download!
             header("Expires: 0");
             header("Cache-Control: must-revalidate");
             header("Content-Type: application/force-download");
             header("Content-Disposition: attachment; filename=$filename");

Vulnerable code:         if($urlFormat == 'path') {
            $getFileLink .= '?path='.$zipfile;
        } else {
            $getFileLink .= '&path='.$zipfile;
        }
    public function getZipFile($path) {
        // echo "<pre>";
        // echo $path."\n";
        // echo $filename."\n";
        // echo "isFile => ".is_file($path) ? 'isFile' : 'isNoFile'."\n";
        // echo "</pre>";
        if (is_file($path) || true) {
Fixed code:         $_SESSION['__path'] = $zipfile;
    /**
     * @return void
     */
    public function getZipFile()
    {
        $path = $_SESSION['__path'];
        unset($_SESSION['__path']);
        if (is_file($path)) {