Vulnerability: Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7.
Vulnerability ID: CVE-2022-1000
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/prasathmani/tinyfilemanager
Published: 2022-03-17
File: tinyfilemanager.php
Commit message: apply fix to path traversal vulnerability (#718)

Co-authored-by: João Maurício <joao.goncalves.mauricio@pwc.com>
Commit author: joaogmauricio

Vulnerable version (before fix):
 function get_file_path () {      $filename = $f['file']['name'];     $tmp_name = $f['file']['tmp_name'];     $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));     $isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;      if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($_REQUEST['fullpath'])) { function get_file_path () {      $targetPath = $path . $ds;     if ( is_writable($targetPath) ) {         $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));          if(file_exists ($fullPath) && !$override_file_name) {             $ext_1 = $ext ? '.'.$ext : '';             $fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1;         }          if (!is_dir($folder)) {

Fixed version (after fix):
 function get_file_path () {      $filename = $f['file']['name'];     $tmp_name = $f['file']['tmp_name'];     $ext = pathinfo($filename, PATHINFO_FILENAME) != '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : '';     $isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;      if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($_REQUEST['fullpath'])) { function get_file_path () {      $targetPath = $path . $ds;     if ( is_writable($targetPath) ) {         $fullPath = $path . '/' . basename($_REQUEST['fullpath']);         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));          if(file_exists ($fullPath) && !$override_file_name) {             $ext_1 = $ext ? '.'.$ext : '';             $fullPath = $path . '/' . basename($_REQUEST['fullpath'], $ext_1) .'_'. date('ymdHis'). $ext_1;         }          if (!is_dir($folder)) {

Patch:
patch: @@ -867,7 +867,7 @@ function get_file_path () {
 
     $filename = $f['file']['name'];
     $tmp_name = $f['file']['tmp_name'];
-    $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
+    $ext = pathinfo($filename, PATHINFO_FILENAME) != '' ? strtolower(pathinfo($filename, PATHINFO_EXTENSION)) : '';
     $isFileAllowed = ($allowed) ? in_array($ext, $allowed) : true;
 
     if(!fm_isvalid_filename($filename) && !fm_isvalid_filename($_REQUEST['fullpath'])) {
@@ -880,12 +880,12 @@ function get_file_path () {
 
     $targetPath = $path . $ds;
     if ( is_writable($targetPath) ) {
-        $fullPath = $path . '/' . str_replace("./","_",$_REQUEST['fullpath']);
+        $fullPath = $path . '/' . basename($_REQUEST['fullpath']);
         $folder = substr($fullPath, 0, strrpos($fullPath, "/"));
 
         if(file_exists ($fullPath) && !$override_file_name) {
             $ext_1 = $ext ? '.'.$ext : '';
-            $fullPath = str_replace($ext_1, '', $fullPath) .'_'. date('ymdHis'). $ext_1;
+            $fullPath = $path . '/' . basename($_REQUEST['fullpath'], $ext_1) .'_'. date('ymdHis'). $ext_1;
         }
 
         if (!is_dir($folder)) {
path: tinyfilemanager.php