GHSA-m63r-m9jh-3vc6

## Summary The directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks the URL **path component** (via `parse_url($url, PHP_URL_PATH)`) for `..` sequences. However, the downstream function `try_get_contents_from_local()` in `objects/functionsFile.php` uses `explode('/videos/', $url)` on the **full URL string** including the query string. An attacker can place the `/videos/../../` traversal payload in the query string to bypass the security check and read arbitrary files from the server filesystem. ## Details The security fix at commit 2375eb5e0 added a traversal check at `objects/aVideoEncoderReceiveImage.json.php:49`: ```php $decodedPath = urldecode((string)(parse_url($_REQUEST[$value], PHP_URL_PATH) ?? '')); if (strpos($decodedPath, '..') !== false) { unset($_REQUEST[$value]); } ``` This only inspects the **path component** of the URL. For a URL like `http://TARGET/x?a=/videos/../../etc/passwd`, `parse_url()` returns `/x` as the path — no `..` is found. The URL then passes through `isValidURL()` (`objects/functions.php:4203`) which accepts it because `FILTER_VALIDATE_URL` considers `..` in query strings valid per RFC 3986. It also passes `isSSRFSafeURL()` (`objects/functions.php:4264`) because the host matches `webSiteRootURL`, causing an early return at line 4294. The URL reaches `url_get_contents()` (`objects/functions.php:1938`) which calls `try_get_contents_from_local()` (`objects/functionsFile.php:214`): ```php function try_get_contents_from_local($url) { // ... $parts = explode('/videos/', $url); if (!empty($parts[1])) { // ... $tryFile = "{$global['systemRootPath']}{$encoder}videos/{$parts[1]}"; if (file_exists($tryFile)) { return file_get_contents($tryFile); } } return false; } ``` `explode('/videos/', $url)` operates on the **entire URL string** including the query string. For the malicious URL, `$parts[1]` becomes `../