ZIP path traversal risk in BundleImportService #168

New Issue

2026-04-10T16:03:57+02:00

shahondin1624 commented

2026-04-10 16:03:57 +02:00

Severity: MEDIUM

Location

lib/Service/BundleImportService.php:325

Description

When extracting ZIP files, $zip->getNameIndex($i) returns the filename as stored in the ZIP, which could contain path traversal sequences (e.g., ../../etc/passwd). While basename() is used to strip directories (line 335), the basename() call happens after the hidden file checks but the content is read from the original index, not the basename. The actual risk is low because the content is only used as CSV data, not written to disk.

Recommendation

Add explicit path traversal validation: reject entries containing .. or absolute paths.

## Severity: MEDIUM ## Location `lib/Service/BundleImportService.php:325` ## Description When extracting ZIP files, `$zip->getNameIndex($i)` returns the filename as stored in the ZIP, which could contain path traversal sequences (e.g., `../../etc/passwd`). While `basename()` is used to strip directories (line 335), the `basename()` call happens after the hidden file checks but the content is read from the original index, not the basename. The actual risk is low because the content is only used as CSV data, not written to disk. ## Recommendation Add explicit path traversal validation: reject entries containing `..` or absolute paths.

shahondin1624 added the backend security priority:medium labels 2026-04-10 16:03:57 +02:00

shahondin1624 referenced this issue from a commit

2026-04-10 16:20:30 +02:00

fix: reject ZIP entries with path traversal sequences (Closes #168)

shahondin1624 referenced a pull request that will close this issue

2026-04-10 16:20:36 +02:00

fix: reject ZIP entries with path traversal sequences (Closes #168) #181

shahondin1624 closed this issue

2026-04-10 16:20:41 +02:00

shahondin1624 referenced this issue from a commit

2026-04-10 16:20:41 +02:00

fix: reject ZIP entries with path traversal sequences (Closes #168) (#181)