Details
Bug
Critical
Description
Zend_View::render() currently allows script names that include parent directory notation – which could lead to a potential local filesystem inclusion exploit if provided unfiltered user input. As view scripts should only ever match beneath the registered view script directories, render() (or _script()) should filter for this sort of input and raise an exception when such input is detected.
Attachments
Issue Links
| This issue is related to: | ||||
| ZF-5724 | Security BUG - LFI is possible, with wrong configuration Zend_View |
|
|
|
Based on
ZF-5724submission, but specific to render() vs. the script paths.ZF-5724submission, but specific to render() vs. the script paths.