starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2017-20186 (published 2023-08-28T13:15Z)

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in nikooo777 ckSurf up to 1.19.2. It has been declared as problematic. This vulnerability affects the function SpecListMenuDead of the file csgo/addons/sourcemod/scripting/ckSurf/misc.sp of the component Spectator List Name Handler. The manipulation of the argument cleanName leads to denial of service. Upgrading to version 1.21.0 is able to address this issue. The name of the patch is fd6318d99083a06363091441a0614bd2f21068e6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-238156. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-404
cwe_name: Improper Resource Shutdown or Release
description: The product does not release or incorrectly releases a resource before it is made available for re-use.
extended_description: When a resource is created or allocated, the developer is responsible for properly releasing the resource as well as accounting for all potential paths of expiration or invalidation, such as a set period of time or revocation.
         

Fix information:
repo_url: https://github.com/nikooo777/ckSurf
commit_details: repo_url: https://github.com/nikooo777/ckSurf
author: Niko Storni
author_date: 2017-05-08 02:26:06+02:00
msg: fixed exploit with names

https://forums.alliedmods.net/showthread.php?t=297179
repository: repo_url: https://github.com/nikooo777/ckSurf
repo_name: nikooo777/ckSurf
description: ckSurf - CSGO Surf Timer
repo_language: SourcePawn
owner: nikooo777
file_changes: filename: misc.sp
change_type: ModificationType.MODIFY
diff: @@ -2465,8 +2465,12 @@ public void SpecListMenuDead(int client) // What Spectators see
 						if (ObservedUser == ObservedUser2)
 						{
 							count++;
+							//strip backslashes from names (causes lags and crashes?)
+							char cleanName[MAX_NAME_LENGTH];
+							Format(cleanName, sizeof(cleanName),"%N",x);
+							ReplaceString(cleanName,sizeof(cleanName),"\\","",false);
 							if (count < 6)
-								Format(sSpecs, 512, "%s%N\n", sSpecs, x);
+								Format(sSpecs, 512, "%s%s\n", sSpecs, cleanName);
 						}
 						if (count == 6)
 							Format(sSpecs, 512, "%s...", sSpecs);

programming_language: C
CVE-2016-10250 (published 2017-03-15T14:59Z)

The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/mdadams/jasper
commit_details: repo_url: https://github.com/mdadams/jasper
author: Michael Adams
author_date: 2016-10-23 03:52:29-07:00
msg: Fixed another problem with incorrect cleanup of JP2 box data upon error.
repository: repo_url: https://github.com/mdadams/jasper
repo_name: jasper-software/jasper
description: Official Repository for the JasPer Image Coding Toolkit
repo_language: C
owner: mdadams
file_changes: filename: jp2_cod.c
change_type: ModificationType.MODIFY
diff: @@ -251,13 +251,16 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
 	if (!(box = jas_malloc(sizeof(jp2_box_t)))) {
 		goto error;
 	}
+
+	// Mark the box data as never having been constructed
+	// so that we will not errantly attempt to destroy it later.
 	box->ops = &jp2_boxinfo_unk.ops;
+
 	if (jp2_getuint32(in, &len) || jp2_getuint32(in, &box->type)) {
 		goto error;
 	}
 	boxinfo = jp2_boxinfolookup(box->type);
 	box->info = boxinfo;
-	box->ops = &boxinfo->ops;
 	box->len = len;
 	JAS_DBGLOG(10, (
 	  "preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
@@ -287,14 +290,15 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
 			goto error;
 		}
 		if (jas_stream_copy(tmpstream, in, box->datalen)) {
-			// Mark the box data as never having been constructed
-			// so that we will not errantly attempt to destroy it later.
-			box->ops = &jp2_boxinfo_unk.ops;
 			jas_eprintf("cannot copy box data\n");
 			goto error;
 		}
 		jas_stream_rewind(tmpstream);
 
+		// From here onwards, the box data will need to be destroyed.
+		// So, initialize the box operations.
+		box->ops = &boxinfo->ops;
+
 		if (box->ops->getdata) {
 			if ((*box->ops->getdata)(box, tmpstream)) {
 				jas_eprintf("cannot parse box data\n");
@@ -327,8 +331,8 @@ void jp2_box_dump(jp2_box_t *box, FILE *out)
 	assert(boxinfo);
 
 	fprintf(out, "JP2 box: ");
-	fprintf(out, "type=%c%s%c (0x%08"PRIxFAST32"); length=%"PRIuFAST32"\n", '"', boxinfo->name,
-	  '"', box->type, box->len);
+	fprintf(out, "type=%c%s%c (0x%08"PRIxFAST32"); length=%"PRIuFAST32"\n", '"',
+	  boxinfo->name, '"', box->type, box->len);
 	if (box->ops->dumpdata) {
 		(*box->ops->dumpdata)(box, out);
 	}

programming_language: C
CVE-2021-4261 (published 2022-12-19T14:15Z)

A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is 29522c90ca1cebfce6453a5af5a45281d99b0646. It is recommended to upgrade the affected component. VDB-216270 is the identifier assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/platzhersh/pacman-canvas
commit_details: repo_url: https://github.com/platzhersh/pacman-canvas
author: Chregi Glatthard
author_date: 2021-05-05 00:21:21+02:00
msg: get rid of sql injection vulnerability
repository: repo_url: https://github.com/platzhersh/pacman-canvas
repo_name: platzhersh/pacman-canvas
description: An old classic, re-written in HTML5.
repo_language: JavaScript
owner: platzhersh
file_changes: filename: db-handler.php
change_type: ModificationType.MODIFY
diff: @@ -96,19 +96,8 @@ function addHighscore($name, $score, $level) {
 	$name_clean = htmlspecialchars($name);
 	$score_clean = htmlspecialchars($score);
 
-	$db->exec('INSERT INTO highscore (name, score, level, date, log_referer, log_user_agent, log_remote_addr, log_remote_host, cheater) '
-		. 'VALUES ("' 
-			. $name . '", ' 
-			. $score . ', ' 
-			. $level . ', "' 
-			. $date . '", "' 
-			. $ref .'", "'
-			. $ua . '", "'
-			. $remA .'", "'
-			. $remH . '", "'
-			. $cheater
-		.'")'
-	);
+	$db->exec('INSERT INTO highscore (name, score, level, date, log_referer, log_user_agent, log_remote_addr, log_remote_host, cheater)VALUES(?,?,?,?,?,?,?,?,?)',$name, $score,$level,$date,$ref,$ua,$remA,$remH,$cheater);
+
 
 	$response['status'] = "success";
 	$response['level'] = $level;

programming_language: PHP
CVE-2021-31571 (published 2021-04-22T18:15Z)

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has an integer overflow in queue.c for queue creation.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/FreeRTOS/FreeRTOS-Kernel
commit_details: repo_url: https://github.com/FreeRTOS/FreeRTOS-Kernel
author: Cobus van Eeden
author_date: 2020-12-07 11:48:51-08:00
msg: add assert for addition overflow on queue creation (#225)
repository: repo_url: https://github.com/FreeRTOS/FreeRTOS-Kernel
repo_name: FreeRTOS/FreeRTOS-Kernel
description: FreeRTOS kernel files only, submoduled into https://github.com/FreeRTOS/FreeRTOS and various other repos.
repo_language: C
owner: FreeRTOS
file_changes: filename: queue.c
change_type: ModificationType.MODIFY
diff: @@ -397,6 +397,9 @@ BaseType_t xQueueGenericReset( QueueHandle_t xQueue,
         /* Check for multiplication overflow. */
         configASSERT( ( uxItemSize == 0 ) || ( uxQueueLength == ( xQueueSizeInBytes / uxItemSize ) ) );
 
+        /* Check for addition overflow. */
+        configASSERT( ( sizeof( Queue_t ) + xQueueSizeInBytes ) >  xQueueSizeInBytes );
+
         /* Allocate the queue and storage area.  Justification for MISRA
          * deviation as follows:  pvPortMalloc() always ensures returned memory
          * blocks are aligned per the requirements of the MCU stack.  In this case

programming_language: C
CVE-2023-49087 (published 2023-11-30T06:15Z)

xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/simplesamlphp/xml-security
commit_details: repo_url: https://github.com/simplesamlphp/xml-security
author: Tim van Dijen
author_date: 2023-11-27 19:17:51+01:00
msg: Merge pull request from GHSA-ww7x-3gxh-qm6r
repository: repo_url: https://github.com/simplesamlphp/xml-security
repo_name: simplesamlphp/xml-security
description: SimpleSAMLphp library for XML Security
repo_language: PHP
owner: simplesamlphp
file_changes: filename: SignedElementTrait.php
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,7 @@ use SimpleSAML\XMLSecurity\Utils\XML;
 use SimpleSAML\XMLSecurity\Utils\XPath;
 use SimpleSAML\XMLSecurity\XML\ds\Reference;
 use SimpleSAML\XMLSecurity\XML\ds\Signature;
+use SimpleSAML\XMLSecurity\XML\ds\SignedInfo;
 use SimpleSAML\XMLSecurity\XML\ds\X509Certificate;
 use SimpleSAML\XMLSecurity\XML\ds\X509Data;
 
@@ -124,12 +125,11 @@ trait SignedElementTrait
 
 
     /**
+     * @param \SimpleSAML\XMLSecurity\XML\ds\SignedInfo $signedInfo
      * @return \SimpleSAML\XMLSecurity\XML\SignedElementInterface
      */
-    private function validateReference(): SignedElementInterface
+    private function validateReference(SignedInfo $signedInfo): SignedElementInterface
     {
-        /** @var \SimpleSAML\XMLSecurity\XML\ds\Signature $this->signature */
-        $signedInfo = $this->signature->getSignedInfo();
         $references = $signedInfo->getReferences();
         Assert::count(
             $references,
@@ -177,8 +177,12 @@ trait SignedElementTrait
         /** @var \SimpleSAML\XMLSecurity\XML\ds\Signature $this->signature */
         $signedInfo = $this->signature->getSignedInfo();
         $c14nAlg = $signedInfo->getCanonicalizationMethod()->getAlgorithm();
+
+        // the canonicalized ds:SignedInfo element (plaintext)
         $c14nSignedInfo = $signedInfo->canonicalize($c14nAlg);
-        $ref = $this->validateReference();
+        $ref = $this->validateReference(
+            SignedInfo::fromXML(DOMDocumentFactory::fromString($c14nSignedInfo)->documentElement),
+        );
 
         if (
             $verifier?->verify(

programming_language: PHP
CVE-2021-40570 (published 2022-01-13T18:15Z)

The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-415
cwe_name: Double Free
description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
extended_description: When a program calls free() twice with the same argument, the program's memory management data structures become corrupted. This corruption can cause the program to crash or, in some circumstances, cause two later calls to malloc() to return the same pointer. If malloc() returns the same value twice and the program later gives the attacker control over the data that is written into this doubly-allocated memory, the program becomes vulnerable to a buffer overflow attack.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-08-30 17:15:34+02:00
msg: fixed #1899
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: av_parsers.c
change_type: ModificationType.MODIFY
diff: @@ -5198,6 +5198,7 @@ static s32 gf_avc_read_sps_bs_internal(GF_BitStream *bs, AVCState *avc, u32 subs
 		sps->offset_for_top_to_bottom_field = gf_bs_read_se_log(bs, "offset_for_top_to_bottom_field");
 		sps->poc_cycle_length = gf_bs_read_ue_log(bs, "poc_cycle_length");
 		if (sps->poc_cycle_length > GF_ARRAY_LENGTH(sps->offset_for_ref_frame)) {
+			sps->poc_cycle_length = 255;
 			GF_LOG(GF_LOG_ERROR, GF_LOG_CODING, ("[avc-h264] offset_for_ref_frame overflow from poc_cycle_length\n"));
 			return -1;
 		}

programming_language: C
CVE-2016-7515 (published 2017-04-19T14:59Z)

The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: dirk
author_date: 2015-10-05 22:11:31+02:00
msg: Fixed check for the number of pixels that will be allocated.
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: rle.c
change_type: ModificationType.MODIFY
diff: @@ -173,6 +173,7 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
     map_length,
     number_colormaps,
     number_planes,
+    number_planes_filled,
     one,
     offset,
     pixel_info_length;
@@ -308,9 +309,12 @@ static Image *ReadRLEImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (image->alpha_trait != UndefinedPixelTrait)
       number_planes++;
     number_pixels=(MagickSizeType) image->columns*image->rows;
-    if ((number_pixels*number_planes) != (size_t) (number_pixels*number_planes))
+    number_planes_filled=(number_planes % 2 == 0) ? number_planes :
+      number_planes+1;
+    if ((number_pixels*number_planes_filled) != (size_t) (number_pixels*
+         number_planes_filled))
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-    pixel_info_length=image->columns*image->rows*MagickMax(number_planes,4);
+    pixel_info_length=image->columns*image->rows*number_planes_filled;
     pixel_info=AcquireVirtualMemory(pixel_info_length,sizeof(*pixels));
     if (pixel_info == (MemoryInfo *) NULL)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");

programming_language: Objective-C
CVE-2013-2559 (published 2014-03-27T16:55Z)

SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/symphonycms/symphony-2
commit_details: repo_url: https://github.com/symphonycms/symphony-2
author: Brendan Abbott
author_date: 2013-03-20 23:02:43+10:00
msg: Fix potential autheticated SQL injection attack on the Authors page
repository: repo_url: https://github.com/symphonycms/symphony-2
repo_name: symphonycms/symphonycms
description: This is the official Symphony CMS repository.
repo_language: PHP
owner: symphonycms
file_changes: filename: class.authormanager.php
change_type: ModificationType.MODIFY
diff: @@ -90,6 +90,8 @@
 		 *  An array of Author objects. If no Authors are found, an empty array is returned.
 		 */
 		public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = null, $start = null, $where = null, $joins = null) {
+			$sortby = is_null($sortby) ? 'id' : Symphony::Database()->cleanValue($sortby);
+			$sortdirection = $sortdirection === 'ASC' ? 'ASC' : 'DESC';
 
 			$records = Symphony::Database()->fetch(sprintf("
 					SELECT a.*
@@ -101,7 +103,7 @@
 				",
 				$joins,
 				($where) ? $where : 1,
-				'a.'.$sortby, $sortdirection,
+				'a.'. $sortby, $sortdirection,
 				($limit) ? "LIMIT " . $limit : '',
 				($start && $limit) ? ', ' . $start : ''
 			));

programming_language: PHP
CVE-2017-7695 (published 2017-04-11T23:59Z)

Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/bigtreecms/BigTree-CMS
commit_details: repo_url: https://github.com/bigtreecms/BigTree-CMS
author: Tim Buckingham
author_date: 2017-04-07 15:11:03-04:00
msg: Fixing empty space at the end of a file name allowing dangerous files to be uploaded.
Thank you to math1as from l-team for the disclosure and fix.

https://github.com/bigtreecms/BigTree-CMS/issues/276
repository: repo_url: https://github.com/bigtreecms/BigTree-CMS
repo_name: bigtreecms/BigTree-CMS
repo_language: PHP
owner: bigtreecms
file_changes: filename: storage.php
change_type: ModificationType.MODIFY
diff: @@ -8,7 +8,7 @@
 
 		var $AutoJPEG = false;
 		var $DisabledFileError = false;
-		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)$/i';
+		var $DisabledExtensionRegEx = '/\\.(exe|com|bat|php|rb|py|cgi|pl|sh|asp|aspx)/i';
 		var $Service = "";
 		var $Cloud = false;
 		var $Settings;

programming_language: PHP
CVE-2020-5297 (published 2020-06-03T22:15Z)

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to upload jpg, jpeg, bmp, png, webp, gif, ico, css, js, woff, woff2, svg, ttf, eot, json, md, less, sass, scss, xml files to any directory of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 2.7, LOW (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-610
cwe_name: Externally Controlled Reference to a Resource in Another Sphere
description: The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/octobercms/october
commit_details: repo_url: https://github.com/octobercms/october
author: Luke Towers
author_date: 2020-03-31 04:09:18-06:00
msg: Improve asset file path handling when moving assets
repository: repo_url: https://github.com/octobercms/october
repo_name: octobercms/october
description: Self-hosted CMS platform based on the Laravel PHP Framework.
repo_language: PHP
owner: octobercms
file_changes: filename: AssetList.php
change_type: ModificationType.MODIFY
diff: @@ -333,13 +333,20 @@ class AssetList extends WidgetBase
 
             $basename = basename($path);
             $originalFullPath = $this->getFullPath($path);
-            $newFullPath = rtrim($destinationFullPath, '/').'/'.$basename;
+            $newFullPath = realpath(rtrim($destinationFullPath, '/')) . '/' . $basename;
             $safeDir = $this->getAssetsPath();
 
             if ($originalFullPath == $newFullPath) {
                 continue;
             }
 
+            if (!starts_with($newFullPath, $safeDir)) {
+                throw new ApplicationException(Lang::get(
+                    'cms::lang.asset.error_moving_file',
+                    ['file' => $basename]
+                ));
+            }
+
             if (is_file($originalFullPath)) {
                 if (!@File::move($originalFullPath, $newFullPath)) {
                     throw new ApplicationException(Lang::get(

programming_language: PHP