Analysis Report · Folder Analysis cache/phastpress_3.7 → cache/phastpress_3.8 — CVE-2025-14388

Vulnerability Existed: yes
TRUE POSITIVE
Path Traversal / Improper Input Validation - CWE-22 - sdk/phast.php lines 9596-9620

Old Code:
```php
private function guard(\Kibo\Phast\ValueObjects\URL $url, callable $cb)
{
    if (!in_array($this->getExtensionForURL($url), self::getAllowedExtensions())) {
        return false;
    }
    $file = $this->getFileForURL($url);
    if ($file === false) {
        return false;
    }
    return $cb($file);
}
private function getExtensionForURL(\Kibo\Phast\ValueObjects\URL $url)
{
    $dotPosition = strrpos($url->getDecodedPath(), '.');
    if ($dotPosition === false) {
        return '';
    }
    return strtolower(substr($url->getDecodedPath(), $dotPosition + 1));
}
```

Fixed Code:
```php
private function guard(\Kibo\Phast\ValueObjects\URL $url, callable $cb)
{
    $file = $this->getFileForURL($url);
    if ($file === false) {
        return false;
    }
    if (!in_array($this->getExtension($file), self::getAllowedExtensions())) {
        return false;
    }
    return $cb($file);
}
private function getExtension($file)
{
    $dotPosition = strrpos($file, '.');
    if ($dotPosition === false) {
        return '';
    }
    return strtolower(substr($file, $dotPosition + 1));
}
```

Explanation:
This fix addresses a critical security vulnerability in the file extension validation logic. The original code validated the extension based on the URL's decoded path (`$url->getDecodedPath()`) before resolving the actual file path. This allowed an attacker to bypass the extension whitelist through URL encoding or path traversal techniques (e.g., `file.php%2e.jpg` or `file.php/..`) where the decoded URL path would appear to have an allowed extension, but the actual resolved file (`$file`) would be a different type.

The fix corrects this by:
1. First resolving the actual file path via `getFileForURL($url)`
2. Then validating the extension of the resolved file path (`getExtension($file)`)
3. Only proceeding with the callback if both the file exists AND has an allowed extension

This ensures that the extension validation is performed on the actual file path that will be processed, not on a potentially manipulated URL representation, preventing path traversal and extension validation bypass attacks.