Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function moveFile($oldPath, $newPath, $isRename = false)
    {
        $oldPath = self::validatePath($oldPath);
        $fullOldPath = $this->getMediaPath($oldPath);

        $newPath = self::validatePath($newPath);
        $fullNewPath = $this->getMediaPath($newPath);

        // If the file extension is changed to SVG, ensure that it has been sanitized
        $oldExt = pathinfo($oldPath, PATHINFO_EXTENSION);
        $newExt = pathinfo($newPath, PATHINFO_EXTENSION);
        if ($oldExt !== $newExt && $newExt === 'svg') {
            $contents = $this->getStorageDisk()->get($fullOldPath);
            $contents = Svg::sanitize($contents);
            $this->getStorageDisk()->put($fullOldPath, $contents);
        }

        return $this->getStorageDisk()->move($fullOldPath, $fullNewPath);
    }