Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    private function getFileName($path, $file_ext, $file_name = false) {

        if(!$file_name){
            if($this->file_name){
                $file_name = str_replace('.'.$file_ext, '', files_sanitize_name($this->file_name.'.'.$file_ext));
            } else {
                $file_name = substr(md5(microtime(true)), 0, 8);
            }
        }

        if (file_exists($path.$file_name.'.'.$file_ext)) {
            return $this->getFileName($path, $file_ext, $file_name.'_'.md5(microtime(true)));
        }

        return $file_name.'.'.$file_ext;

    }