GHSA-6rc6-p838-686f

## Summary The locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` parameter is then written verbatim to that path via `fwrite()` at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use `SameSite=None`) can traverse out of the `locale/` directory and write arbitrary `.php` files to any writable location on the filesystem, achieving Remote Code Execution. ## Details In `locale/save.php`, the vulnerable code path is: ```php // locale/save.php:10 — only auth check, no CSRF token if (!User::isAdmin() || !empty($global['disableAdvancedConfigurations'])) { // ... die(json_encode($obj)); } // locale/save.php:16 — base directory $dir = "{$global['systemRootPath']}locale/"; // locale/save.php:30 — UNSANITIZED path concatenation $file = $dir.($_POST['flag']).".php"; $myfile = fopen($file, "w") or die("Unable to open file!"); // locale/save.php:40 — UNSANITIZED content write fwrite($myfile, $_POST['code']); ``` **Root cause**: `$_POST['flag']` is concatenated directly into the file path with no call to `basename()`, `realpath()`, or any filtering of `../` sequences. A `flag` value like `../../shell` resolves to `{systemRootPath}locale/../../shell.php`, which escapes the locale directory and writes to `{systemRootPath}../shell.php` — the web-accessible parent directory. The file content is constructed as: ```php <?php global $t; {$_POST['code']} // attacker-controlled, written verbatim ``` An attacker can inject arbitrary PHP after closing the translation context (e.g., `$t["x"]=1;?><?php system($_GET["c"]);`). **CSRF amplification**: The endpoint performs no CSRF token validation. AVideo intentionally sets `SameSite=None` on session cookies (for cross-origin iframe support), which means cross-site POST requests from an attacker's page will include the admin's session cookie, m