GHSA-9j59-qcxw-q7qm: 
PHP vulnerability analysis and mitigation

Summary

sanitize_filename() (and the deprecated Security::sanitizeFilename() alias) did not neutralize backslashes during filtering. A final stripslashes() call ran after the traversal filters, so crafted backslash sequences could produce ../ on all platforms, when $relativePath is true, keep \ as a directory separator on Windows in both modes, or introduce a NUL byte. Applications that pass user-supplied names or relative paths through this function and then use the result in filesystem operations may read or write files outside the intended directory.

Details

sanitize_filename() filters blocked sequences in a loop and then returns stripslashes($filename). Backslashes were not filtered, so stripslashes() could change the already-sanitized string:

• With $relativePath = true, .\./ passes the filters and becomes ../ (all platforms).
• \\ becomes \, which acts as a directory separator on Windows (both modes).
• \0 becomes a NUL byte. Framework call sites are not practically exploitable: PHP strips path components from uploaded file names. The main risk is application code that passes user input, such as request parameters or UploadedFile::getClientPath(), to the function. The fix removes backslashes inside the filtering loop and drops the stripslashes() call.

Proof of concept

On CodeIgniter 4.7.5 or earlier:

helper('security');
// 1. Relative path mode, all platforms
var_dump(sanitize_filename('.\\./.\\./app/Config/Database.php', true));
// string(29) "../../app/Config/Database.php"
// 2. Repeated backslashes, Windows separator
var_dump(sanitize_filename('..\\\\..\\\\public\\\\shell.php'));
// string(22) "..\..\public\shell.php"
// 3. NUL byte
var_dump(bin2hex(sanitize_filename('report\\0.txt')));
// string(22) "7265706f7274002e747874"  (contains 00)

Vulnerable application pattern:

$path = sanitize_filename($this->request->getGet('file'), true);
return $this->response->setBody(file_get_contents(WRITEPATH . 'exports/' . $path));
// GET /download?file=.%5C./.%5C./.env  ->  reads WRITEPATH/exports/../../.env

On 4.7.6, the same inputs return app/Config/Database.php, ....publicshell.php, and report0.txt.

Impact

Path traversal (CWE-22) and NUL byte injection (CWE-158). Affected applications are those that pass user-controlled input through sanitize_filename() or Security::sanitizeFilename() and use the result as part of a filesystem path. With $relativePath = true, all platforms are affected. With the default mode, traversal requires a Windows host. Depending on how the result is used, an attacker may read, overwrite, or create files outside the intended directory. Standard file uploads handled by UploadedFile::move() are not affected. Users should upgrade to 4.7.6. If upgrading is not possible, reject input containing \ before calling the function, or generate filenames on the server instead of using client-supplied names.