Severity: MEDIUM
Location: src/Controllers/AdminFileController.php:238, 334
Bug: Path traversal defense missing vs a poisoned DB row.
Fix: Wrap stored_name in basename() before joining to uploads directory.
Status: open. Will reply with remediation details when resolved.
Resolved.
Resolved alongside H-2. AdminFileController::reject and AdminFileController::deleteFile now both pass stored_name through basename() before joining to the uploads directory:
$storedPath = BASE_PATH . '/storage/uploads/files/' . basename((string) $file['stored_name']);
See thread #1668 (H-2) for context. Real-world stored_name values are UUIDs, but the guard is zero-cost and protects against any future injection or backup-restore poisoning.
Locking this thread.