Fixed a potential RCE vulnerability

craftcms · Jun 27, 2023 · 0bd3386 · 0bd3386
1 parent a2ece09
commit 0bd3386
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Release Notes for Craft CMS 3.x
 
+## Unreleased
+
+- Fixed an RCE vulnerability.
+
 ## 3.8.14 - 2023-06-13
 
 - The `_includes/forms/date` and `_includes/forms/time` templates now accept a `timeZone` variable.

diff --git a/src/helpers/FileHelper.php b/src/helpers/FileHelper.php
@@ -44,6 +44,9 @@ class FileHelper extends \yii\helpers\FileHelper
      */
     public static function normalizePath($path, $ds = DIRECTORY_SEPARATOR)
     {
+        // Remove any file protocol wrappers
+        $path = StringHelper::removeLeft($path, 'file://');
+
         // Is this a UNC network share path?
         $isUnc = (strpos($path, '//') === 0 || strpos($path, '\\\\') === 0);