GHSA-88g4-74f3-63x9

## Summary There is an authenticated path traversal condition in the PDF export functionality, specifically within the PDF image resolution logic. The issue may allow a privileged FAQ editor to cause the application to attempt reading files outside the intended content directory during PDF generation. --- ## Affected Component **File:** `src/phpMyFAQ/Export/Pdf/Wrapper.php` **Function:** `concatenatePaths()` --- ## Root Cause The path resolution logic relies on locating the substring `"content"` within a user-controlled path: ```php $pos = strpos($trimmedFile, 'content'); $relativePath = substr($trimmedFile, (int) $pos); ``` If `"content"` is not present, `strpos()` returns `false`, which becomes `0` when cast to an integer. As a result, the entire attacker-controlled path is preserved. Example: ```php $trimmedFile = "../../../etc/passwd"; $pos = false; $relativePath = "../../../etc/passwd"; ``` The resulting path is later processed by: ```php file_get_contents($resolvedPath); ``` without canonicalization or a root-directory containment check. --- ## Observed Data Flow ```text FAQ Content -> PDF Export -> WriteHTML() -> Wrapper::Image() -> concatenatePaths() -> file_get_contents() ``` --- ## Potential Impact Based on code review, a user with FAQ editing privileges may be able to store HTML containing crafted image paths that are processed during PDF generation. Potential consequences may include: - Path traversal outside the intended content directory - Local file read attempts during PDF export - Possible disclosure of readable files depending on file type, sanitization behavior, and PDF rendering constraints --- ## Discovery Method This issue was initially detected by an internally developed SAST tool during analysis of the phpMyFAQ source code. The finding was then manually investigated and validated through code review. While the original scanner output classified the issue as a generic path traversal/local file