[php-src] Issue #24574: Session upload progress filename sanitation
| From: | sykeops | Date: | Thu, 22 Oct 2026 19:54:06 +0000 |
| Subject: | [php-src] Issue #24574: Session upload progress filename sanitation | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253113@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24574
Author: sykeops
### Description
Session upload progress has no sanitation of the filename which allows RCE if let's say
there's LFI in the website. One of the criteria is .user.ini/php.ini
`
session.upload_progress.enabled = On, and
session.upload_progress.cleanup = Off`
<img width="1089" height="531" alt="Image" src="https://github.com/user-attachments/assets/3cb65dd9-da04-4247-a3fa-72d3572b25db"
/>
<img width="1076" height="118" alt="Image" src="https://github.com/user-attachments/assets/042ca757-c12c-4b7d-a3c5-08af5e5c2ebc"
/>
### PHP Version
```plain
PHP 8.5.12 (cli) (built: Oct 19 2026 17:02:46) (NTS gcc x86_64)
Copyright (c) The PHP Group
Built by Fedora Project
Zend Engine v4.5.12, Copyright (c) Zend Technologies
with Zend OPcache v8.5.12, Copyright (c), by Zend Technologies
```
### Operating System
Fedora 44 (Server Edition)