trim($this->root, '/') strips the leading slash from the root path,
making strlen() return a value 1 less than expected. This causes
substr() to include an extra character from the root folder name
in the relative path.
For example, with root folder "images":
- Expected URL: /files/image.jpg
- Actual URL: /files/s/image.jpg
Using strlen($this->root) + 1 is consistent with other URL
construction methods in elFinderVolumeLocalFileSystem (lines 206,
612, 845, 1420) which all use this correct pattern.
Fixes#3746
* CVE-2025-0818 (Part 1)
- Fixed arbitrary file delete by prepending the tempath to the global temp file array paths before deleting them
- This also required a new global array (elFinderAbortFiles) because the temp path could be different depeing on the configuration of elFInder.
- Removed the ability of getTempPath() to return the writableTmb path because this would unnecessarly complicate things when checking the path before deletion
* CVE-2025-0818 (Part II)
- Prevented arbitrary file read by prepending the common temp directory to the extracted onetime file path of the 'file' commands 'ontime' function.
- Prevented directory traversal and the general use of paths by using basename() for the appended file name.
- This patch currently prevents arbitrary file reads and deletes. However, it still allows this for files in the .tmp directory. This should also at least be mitigated.
Fixed a paste traversal vulnerability. The problem was getting out of
the configured directory and allowing the hosting server's file system
to read and write "arbitrary" files.
Special thanks to Gaetan Ferry (Synacktiv) for reporting this issue.
* [php] fix multiple vulnerabilities
* fix archiver args
* fix remote Code Execution of zip command
* re-fix remote Code Execution of zip command
* re-fix Improper hostname validation in upload and put
* re-fix Directory traversal in the actions mkfile and mkdir
* Add check targets in archive()
Rewrite logic for to get mimeDetect for clarity and to resolve a small bug.
This line causes a bug where it becomes impossible to set mimeDetect to 'mime_content_type': https://github.com/Studio-42/elFinder/blob/33eea861cb07196edbde5d9188f65a6ce81be21f/php/elFinderVolumeDriver.class.php#L1290
The logic here first makes an array of methods available in the current environment. Then we check to see if the type set is among them. If not, set to auto. If set to auto, shift the first element from available types.
nao-pon