Language: PHP
Label: vulnerable
CWE: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Code:
    private function convert2pdf($file,$cacheFile,$ext){
		$command = $this->getSoffice();
		if(!$command){
			Action($this->pluginName)->showTips(LNG('officeViewer.libreOffice.sofficeError'), 'LibreOffice');
		}
		//linux下$cacheFile不可写问题，先生成到/tmp下;再复制出来
		$tempPath = $cacheFile;
		if($GLOBALS['config']['systemOS'] == 'linux' && is_writable('/tmp/')){
			mk_dir('/tmp/libreOffice');
			$tempPath = '/tmp/libreOffice/'.rand_string(15).'.pdf';
		}
        $fname = get_path_this($tempPath);
        $fpath = get_path_father($tempPath);
        // 转换类型'pdf'改为'新文件名.pdf'，会生成'源文件名.新文件名.pdf'
		$export = 'export HOME=/tmp/libreOffice && ';
        $script = $export.$command . ' --headless --invisible --convert-to '.$fname.' "'.$file.'" --outdir '.$fpath;
		$out = shell_exec($script);

        $tname = substr(end(explode('/', $file)), 0, -strlen('.'.$ext));
        $tfile = $fpath . $tname . '.' . $fname;    // 源文件名.filename.pdf
        if(!file_exists($tfile)){
            write_log('libreoffice convert error: '.$script."\n".$out,'error');
        }
		$res = move_path($tfile,$cacheFile);
		if (!$res) write_log('libreoffice move file error: '.$tfile.'=>'.$cacheFile, 'error');
	}