rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than CVE-2017-12192.
Vulnerability ID: CVE-2017-15274
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2017-10-12
File: security/keys/keyctl.c
Commit message: KEYS: fix dereferencing NULL payload with nonzero length

sys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl() allowed a
NULL payload with nonzero length to be passed to the key type's
->preparse(), ->instantiate(), and/or ->update() methods.  Various key
types including asymmetric, cifs.idmap, cifs.spnego, and pkcs7_test did
not handle this case, allowing an unprivileged user to trivially cause a
NULL pointer dereference (kernel oops) if one of these key types was
present.  Fix it by doing the copy_from_user() when 'plen' is nonzero
rather than when '_payload' is non-NULL, causing the syscall to fail
with EFAULT as expected when an invalid buffer is specified.

Cc: stable@vger.kernel.org # 2.6.10+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Commit author: Eric Biggers

Vulnerable version (before fix):
 SYSCALL_DEFINE5(add_key, const char __user *, _type, 	/* pull the payload in if one was supplied */ 	payload = NULL;  	if (_payload) { 		ret = -ENOMEM; 		payload = kvmalloc(plen, GFP_KERNEL); 		if (!payload) long keyctl_update_key(key_serial_t id,  	/* pull the payload in if one was supplied */ 	payload = NULL; 	if (_payload) { 		ret = -ENOMEM; 		payload = kmalloc(plen, GFP_KERNEL); 		if (!payload)

Fixed version (after fix):
 SYSCALL_DEFINE5(add_key, const char __user *, _type, 	/* pull the payload in if one was supplied */ 	payload = NULL;  	if (plen) { 		ret = -ENOMEM; 		payload = kvmalloc(plen, GFP_KERNEL); 		if (!payload) long keyctl_update_key(key_serial_t id,  	/* pull the payload in if one was supplied */ 	payload = NULL; 	if (plen) { 		ret = -ENOMEM; 		payload = kmalloc(plen, GFP_KERNEL); 		if (!payload)

Patch:
patch: @@ -99,7 +99,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 	/* pull the payload in if one was supplied */
 	payload = NULL;
 
-	if (_payload) {
+	if (plen) {
 		ret = -ENOMEM;
 		payload = kvmalloc(plen, GFP_KERNEL);
 		if (!payload)
@@ -324,7 +324,7 @@ long keyctl_update_key(key_serial_t id,
 
 	/* pull the payload in if one was supplied */
 	payload = NULL;
-	if (_payload) {
+	if (plen) {
 		ret = -ENOMEM;
 		payload = kmalloc(plen, GFP_KERNEL);
 		if (!payload)
path: security/keys/keyctl.c
Vulnerability: ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when processing a GIF file that has neither a global nor local palette. If the affected product is used as a library loaded into a process that operates on interesting data, this data sometimes can be leaked via the uninitialized palette.
Vulnerability ID: CVE-2017-15277
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-10-12
File: coders/gif.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/592
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)     MagickMax(global_colors,256),3UL*sizeof(*global_colormap));   if (global_colormap == (unsigned char *) NULL)     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");   if (BitSet((int) flag,0x80) != 0)     {       count=ReadBlob(image,(size_t) (3*global_colors),global_colormap);

Fixed version (after fix):
 static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)     MagickMax(global_colors,256),3UL*sizeof(*global_colormap));   if (global_colormap == (unsigned char *) NULL)     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");   (void) ResetMagickMemory(global_colormap,0,3*MagickMax(global_colors,256)*     sizeof(*global_colormap));   if (BitSet((int) flag,0x80) != 0)     {       count=ReadBlob(image,(size_t) (3*global_colors),global_colormap);

Patch:
patch: @@ -1018,6 +1018,8 @@ static Image *ReadGIFImage(const ImageInfo *image_info,ExceptionInfo *exception)
     MagickMax(global_colors,256),3UL*sizeof(*global_colormap));
   if (global_colormap == (unsigned char *) NULL)
     ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+  (void) ResetMagickMemory(global_colormap,0,3*MagickMax(global_colors,256)*
+    sizeof(*global_colormap));
   if (BitSet((int) flag,0x80) != 0)
     {
       count=ReadBlob(image,(size_t) (3*global_colors),global_colormap);
path: coders/gif.c
Vulnerability: Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.
Vulnerability ID: CVE-2017-15284
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/octobercms/library
Published: 2017-10-12
File: src/Filesystem/Definitions.php
Commit message: Remove SVG from image types

SVG files should not be treated as images - especially when coming to uploads. An SVG file can contain arbitrary HTML data as well as event handlers in native elements
Refs: https://html5sec.org/#svg
Original report by: Ishaq Mohammed
Commit author: Samuel Georges

Vulnerable version (before fix):
 protected function imageExtensions()             'bmp',             'png',             'webp',             'gif',             'svg'         ];     } 

Fixed version (after fix):
 protected function imageExtensions()             'bmp',             'png',             'webp',             'gif'         ];     } 

Patch:
patch: @@ -182,8 +182,7 @@ protected function imageExtensions()
             'bmp',
             'png',
             'webp',
-            'gif',
-            'svg'
+            'gif'
         ];
     }
path: src/Filesystem/Definitions.php
Vulnerability: The kvm_vm_ioctl_check_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl call to /dev/kvm.
Vulnerability ID: CVE-2017-15306
CWE: CWE-476
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2017-11-06
File: arch/powerpc/kvm/powerpc.c
Commit message: KVM: PPC: Fix oops when checking KVM_CAP_PPC_HTM

The following program causes a kernel oops:

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/kvm.h>

main()
{
    int fd = open("/dev/kvm", O_RDWR);
    ioctl(fd, KVM_CHECK_EXTENSION, KVM_CAP_PPC_HTM);
}

This happens because when using the global KVM fd with
KVM_CHECK_EXTENSION, kvm_vm_ioctl_check_extension() gets
called with a NULL kvm argument, which gets dereferenced
in is_kvmppc_hv_enabled(). Spotted while reading the code.

Let's use the hv_enabled fallback variable, like everywhere
else in this function.

Fixes: 23528bb21ee2 ("KVM: PPC: Introduce KVM_CAP_PPC_HTM")
Cc: stable@vger.kernel.org # v4.7+
Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Commit author: Greg Kurz

Vulnerable version (before fix):
 int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) 		break; #endif 	case KVM_CAP_PPC_HTM: 		r = cpu_has_feature(CPU_FTR_TM_COMP) && 		    is_kvmppc_hv_enabled(kvm); 		break; 	default: 		r = 0;

Fixed version (after fix):
 int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) 		break; #endif 	case KVM_CAP_PPC_HTM: 		r = cpu_has_feature(CPU_FTR_TM_COMP) && hv_enabled; 		break; 	default: 		r = 0;

Patch:
patch: @@ -644,8 +644,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 		break;
 #endif
 	case KVM_CAP_PPC_HTM:
-		r = cpu_has_feature(CPU_FTR_TM_COMP) &&
-		    is_kvmppc_hv_enabled(kvm);
+		r = cpu_has_feature(CPU_FTR_TM_COMP) && hv_enabled;
 		break;
 	default:
 		r = 0;
path: arch/powerpc/kvm/powerpc.c
Vulnerability: Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.
Vulnerability ID: CVE-2017-15367
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/bacula-web/bacula-web
Published: 2018-03-07
File: client-report.php
Commit message: Ensure provided period is a valid integer and a known value

  - if provided period is not an integer or a known value, we
    raise an exception
Commit author: Davide Franco

Vulnerable version (before fix):
         $period = CHttpRequest::get_Value('period');         $view->assign( 'no_report_options', 'false');                // Client informations

Fixed version (after fix):
         $period = CHttpRequest::get_Value('period');         // Check if period is an integer and listed in known periods        if(!array_key_exists( $period, $periods_list)) {           throw new Exception('Critical: provided value for (period) is unknown or not valid');        }         if(!filter_var($period, FILTER_VALIDATE_INT)) {           throw new Exception('Critical: provided value for (period) is unknown or not valid');        }         $view->assign( 'no_report_options', 'false');                // Client informations

Patch:
patch: @@ -64,6 +64,15 @@
 
        $period = CHttpRequest::get_Value('period');
 
+       // Check if period is an integer and listed in known periods
+       if(!array_key_exists( $period, $periods_list)) {
+          throw new Exception('Critical: provided value for (period) is unknown or not valid');
+       }
+
+       if(!filter_var($period, FILTER_VALIDATE_INT)) {
+          throw new Exception('Critical: provided value for (period) is unknown or not valid');
+       }
+
        $view->assign( 'no_report_options', 'false');
        
        // Client informations
path: client-report.php
Vulnerability: The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service (r_read_le16 invalid write and application crash) or possibly have unspecified other impact via a crafted ELF file.
Vulnerability ID: CVE-2017-15385
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2017-10-16
File: libr/bin/format/elf/elf.c
Commit message: Fix #8685 - Crash in ELF version parsing
Commit author: pancake

Vulnerable version (before fix):
 static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 	sdb_num_set (sdb, "link", shdr->sh_link, 0); 	sdb_set (sdb, "link_section_name", link_section_name, 0);  	for (cnt = 0, i = 0; cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) { 		Sdb *sdb_verdef = sdb_new0 (); 		char *vstart = ((char*)defs) + i; 		char key[32] = {0}; static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 			sdb_free (sdb_verdef); 			goto out_error; 		} 		i += verdef->vd_next; 	} 	free (defs);

Fixed version (after fix):
 static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 	sdb_num_set (sdb, "link", shdr->sh_link, 0); 	sdb_set (sdb, "link_section_name", link_section_name, 0);  	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) { 		Sdb *sdb_verdef = sdb_new0 (); 		char *vstart = ((char*)defs) + i; 		char key[32] = {0}; static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz) 			sdb_free (sdb_verdef); 			goto out_error; 		} 		if ((st32)verdef->vd_next < 1) { 			eprintf ("Warning: Invalid vd_next in the ELF version\n"); 			break; 		} 		i += verdef->vd_next; 	} 	free (defs);

Patch:
patch: @@ -731,7 +731,7 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 	sdb_num_set (sdb, "link", shdr->sh_link, 0);
 	sdb_set (sdb, "link_section_name", link_section_name, 0);
 
-	for (cnt = 0, i = 0; cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
+	for (cnt = 0, i = 0; i >= 0 && cnt < shdr->sh_info && ((char *)defs + i < end); ++cnt) {
 		Sdb *sdb_verdef = sdb_new0 ();
 		char *vstart = ((char*)defs) + i;
 		char key[32] = {0};
@@ -802,6 +802,10 @@ static Sdb *store_versioninfo_gnu_verdef(ELFOBJ *bin, Elf_(Shdr) *shdr, int sz)
 			sdb_free (sdb_verdef);
 			goto out_error;
 		}
+		if ((st32)verdef->vd_next < 1) {
+			eprintf ("Warning: Invalid vd_next in the ELF version\n");
+			break;
+		}
 		i += verdef->vd_next;
 	}
 	free (defs);
path: libr/bin/format/elf/elf.c
Vulnerability: Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php.
Vulnerability ID: CVE-2017-15538
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ILIAS-eLearning/ILIAS
Published: 2017-10-17
File: Services/MediaObjects/classes/class.ilMediaItem.php
Commit message: fixed bug #0021435
Commit author: Alexander Killing

Vulnerable version (before fix):
 function getHAlign() 	*/ 	function setParameter($a_name, $a_value) 	{ 		$this->parameters[$a_name] = $a_value; 	}  	/** function setParameters($a_par) 		} 	}   	/** 	* get all parameters (in array)

Fixed version (after fix):
 function getHAlign() 	*/ 	function setParameter($a_name, $a_value) 	{ 		if ($this->checkParameter($a_name, $a_value)) 		{ 			$this->parameters[$a_name] = $a_value; 		} 	}  	/** function setParameters($a_par) 		} 	}  	/** 	 * Check parameter (filter javascript related and other unsafe parameters/values) 	 * 	 * @param string $a_par parameter 	 * @param string $a_val value 	 * @return bool 	 */ 	function checkParameter($a_par, $a_val) 	{ 		// do not allow event attributes 		if (substr(strtolower(trim($a_par)), 0, 2) == "on") 		{ 			return false; 		} 		// no javascript in value 		if (is_int(strpos(strtolower($a_val), "javascript"))) 		{ 			return false; 		} 		// do not allow to change the src attribute 		if (in_array(strtolower(trim($a_par)), array("src"))) 		{ 			return false; 		}  		return true; 	}   	/** 	* get all parameters (in array)

Patch:
patch: @@ -671,7 +671,10 @@ function getHAlign()
 	*/
 	function setParameter($a_name, $a_value)
 	{
-		$this->parameters[$a_name] = $a_value;
+		if ($this->checkParameter($a_name, $a_value))
+		{
+			$this->parameters[$a_name] = $a_value;
+		}
 	}
 
 	/**
@@ -700,6 +703,34 @@ function setParameters($a_par)
 		}
 	}
 
+	/**
+	 * Check parameter (filter javascript related and other unsafe parameters/values)
+	 *
+	 * @param string $a_par parameter
+	 * @param string $a_val value
+	 * @return bool
+	 */
+	function checkParameter($a_par, $a_val)
+	{
+		// do not allow event attributes
+		if (substr(strtolower(trim($a_par)), 0, 2) == "on")
+		{
+			return false;
+		}
+		// no javascript in value
+		if (is_int(strpos(strtolower($a_val), "javascript")))
+		{
+			return false;
+		}
+		// do not allow to change the src attribute
+		if (in_array(strtolower(trim($a_par)), array("src")))
+		{
+			return false;
+		}
+
+		return true;
+	}
+
 
 	/**
 	* get all parameters (in array)
path: Services/MediaObjects/classes/class.ilMediaItem.php
Vulnerability: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.
Vulnerability ID: CVE-2017-15568
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/redmine/redmine
Published: 2017-10-18
File: app/helpers/application_helper.rb
Commit message: Ensure that values of multi-value fields are HTML-escaped in issue history (#27186).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@16985 e93f8b46-1217-0410-a6f0-8f06a7374b81
Commit author: Jean-Philippe Lang

Vulnerable version (before fix):
 def format_object(object, html=true, &block)     end     case object.class.name     when 'Array'       object.map {|o| format_object(o, html)}.join(', ').html_safe     when 'Time'       format_time(object)     when 'Date'

Fixed version (after fix):
 def format_object(object, html=true, &block)     end     case object.class.name     when 'Array'       formatted_objects = object.map {|o| format_object(o, html)}       html ? safe_join(formatted_objects, ', ') : formatted_objects.join(', ')     when 'Time'       format_time(object)     when 'Date'

Patch:
patch: @@ -177,7 +177,8 @@ def format_object(object, html=true, &block)
     end
     case object.class.name
     when 'Array'
-      object.map {|o| format_object(o, html)}.join(', ').html_safe
+      formatted_objects = object.map {|o| format_object(o, html)}
+      html ? safe_join(formatted_objects, ', ') : formatted_objects.join(', ')
     when 'Time'
       format_time(object)
     when 'Date'
path: app/helpers/application_helper.rb
Vulnerability: In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
Vulnerability ID: CVE-2017-15569
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/redmine/redmine
Published: 2017-10-18
File: app/helpers/queries_helper.rb
Commit message: Ensure that values of multi-value fields are HTML-escaped in issue list (#27186).

Patch by Holger Just.

git-svn-id: http://svn.redmine.org/redmine/trunk@16984 e93f8b46-1217-0410-a6f0-8f06a7374b81
Commit author: Jean-Philippe Lang

Vulnerable version (before fix):
 def column_header(query, column, options={})   def column_content(column, item)     value = column.value_object(item)     if value.is_a?(Array)       value.collect {|v| column_value(column, item, v)}.compact.join(', ').html_safe     else       column_value(column, item, value)     end

Fixed version (after fix):
 def column_header(query, column, options={})   def column_content(column, item)     value = column.value_object(item)     if value.is_a?(Array)       values = value.collect {|v| column_value(column, item, v)}.compact       safe_join(values, ', ')     else       column_value(column, item, value)     end

Patch:
patch: @@ -201,7 +201,8 @@ def column_header(query, column, options={})
   def column_content(column, item)
     value = column.value_object(item)
     if value.is_a?(Array)
-      value.collect {|v| column_value(column, item, v)}.compact.join(', ').html_safe
+      values = value.collect {|v| column_value(column, item, v)}.compact
+      safe_join(values, ', ')
     else
       column_value(column, item, value)
     end
path: app/helpers/queries_helper.rb
Vulnerability: The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4 and possibly earlier allows remote attackers to have unspecified impact via a crafted MP4 file, which triggers an out-of-bounds read.
Vulnerability ID: CVE-2017-15672
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-11-06
File: libavcodec/ffv1dec.c
Commit message: avcodec/ffv1dec: Fix out of array read in slice counting

Fixes: test-201710.mp4

Found-by: 连一汉 <lianyihan@360.cn> and Zhibin Hu
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit c20f4fcb74da2d0432c7b54499bb98f48236b904)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int read_header(FFV1Context *f)     } else {         const uint8_t *p = c->bytestream_end;         for (f->slice_count = 0;              f->slice_count < MAX_SLICES && 3 < p - c->bytestream_start;              f->slice_count++) {             int trailer = 3 + 5*!!f->ec;             int size = AV_RB24(p-trailer);

Fixed version (after fix):
 static int read_header(FFV1Context *f)     } else {         const uint8_t *p = c->bytestream_end;         for (f->slice_count = 0;              f->slice_count < MAX_SLICES && 3 + 5*!!f->ec < p - c->bytestream_start;              f->slice_count++) {             int trailer = 3 + 5*!!f->ec;             int size = AV_RB24(p-trailer);

Patch:
patch: @@ -787,7 +787,7 @@ static int read_header(FFV1Context *f)
     } else {
         const uint8_t *p = c->bytestream_end;
         for (f->slice_count = 0;
-             f->slice_count < MAX_SLICES && 3 < p - c->bytestream_start;
+             f->slice_count < MAX_SLICES && 3 + 5*!!f->ec < p - c->bytestream_start;
              f->slice_count++) {
             int trailer = 3 + 5*!!f->ec;
             int size = AV_RB24(p-trailer);
path: libavcodec/ffv1dec.c
Vulnerability: In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.
Vulnerability ID: CVE-2017-15727
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/thorsten/phpMyFAQ
Published: 2017-10-22
File: phpmyfaq/admin/attachment.php
Commit message: Prevent users to upload HTML files as attachments
Commit author: Thorsten Rinne

Vulnerable version (before fix):
     <strong><?php echo $PMF_LANG['ad_att_addto'].' '.$PMF_LANG['ad_att_addto_2'] ?></strong> </p> <?php     if (is_uploaded_file($_FILES['userfile']['tmp_name']) && !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize'))) {         $att = PMF_Attachment_Factory::create();         $att->setRecordId($recordId);         $att->setRecordLang($recordLang);

Fixed version (after fix):
     <strong><?php echo $PMF_LANG['ad_att_addto'].' '.$PMF_LANG['ad_att_addto_2'] ?></strong> </p> <?php     if (         is_uploaded_file($_FILES['userfile']['tmp_name']) &&         !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize')) &&         $_FILES['userfile']['type'] !== "text/html"     ) {         $att = PMF_Attachment_Factory::create();         $att->setRecordId($recordId);         $att->setRecordLang($recordLang);

Patch:
patch: @@ -139,7 +139,11 @@
     <strong><?php echo $PMF_LANG['ad_att_addto'].' '.$PMF_LANG['ad_att_addto_2'] ?></strong>
 </p>
 <?php
-    if (is_uploaded_file($_FILES['userfile']['tmp_name']) && !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize'))) {
+    if (
+        is_uploaded_file($_FILES['userfile']['tmp_name']) &&
+        !($_FILES['userfile']['size'] > $faqConfig->get('records.maxAttachmentSize')) &&
+        $_FILES['userfile']['type'] !== "text/html"
+    ) {
         $att = PMF_Attachment_Factory::create();
         $att->setRecordId($recordId);
         $att->setRecordLang($recordLang);
path: phpmyfaq/admin/attachment.php