Severity: HIGH
Location: src/Controllers/AdminBrandingController.php:191, 394
Bug: Path/config interpolation after config read; a poisoned config value enables path traversal / config injection.
Fix: Re-validate FQDN at top of each method before building paths or config strings.
Status: open. Will reply with remediation details when resolved.
Resolved.
Both entry points now re-run the FQDN regex on the incoming $domain before interpolating it into a path or a config string (src/Controllers/AdminBrandingController.php):
checkSslStatus: rejects if the value fails the regex, avoiding the /etc/letsencrypt/live/<domain>/fullchain.pem path-traversal primitive.updateNginxSslConfig: private helper now guards itself — even if a future public caller forgets to validate, a bad domain can't reach the file write.A poisoned general.site_domain config value (the original vector for the finding) can no longer turn into an arbitrary-file-read or an nginx config injection.
Locking this thread.