CVE-2026-42551: Arbitrary File Write Via Upload Movecve-2026-42551-arbitrary-file-write-via-upload-move
Moving an uploaded file to an unvalidated destination path can allow attackers to write arbitrary files (e.g., web shells) to the server via directory traversal sequences ('..') or absolute paths. Validate the destination path using 'basename()', 'realpath()', or strict string checks before moving the file.
