CVE-2026-116255: Php Tainted File Read Path Traversalcve-2026-116255-php-tainted-file-read-path-traversal
Request-controlled URI path data is exploded/imploded into segments and concatenated onto a filesystem base directory, and the resulting path is used in a filesystem operation (read or existence probe) without realpath() canonicalization and a root-prefix containment check (resolved path must equal the intended root or start with root . DIRECTORY_SEPARATOR).
