Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    private function uploadPackage(){

        $this->cms_uploader->enableRemoteUpload();

        if (!$this->cms_uploader->isUploaded($this->upload_name) && !$this->cms_uploader->isUploadedFromLink($this->upload_name)){

            $last_error = $this->cms_uploader->getLastError();
            if($last_error){
                cmsUser::addSessionMessage($last_error, 'error');
            }

            return false;

        }

        files_clear_directory(cmsConfig::get('upload_path') . $this->installer_upload_path);

        $result = $this->cms_uploader->upload($this->upload_name, $this->upload_exts, 0, $this->installer_upload_path);

        if (!$result['success']){
            cmsUser::addSessionMessage($result['error'], 'error');
            return false;
        }

        return $result['name'];

    }