CVE-2026-85200: Php Insecure Realpath Prefix Validationcve-2026-85200-php-insecure-realpath-prefix-validation
Directly concatenating 'realpath()' with a directory separator without verifying that 'realpath()' did not return false creates an insecure base path prefix. If the path does not exist, 'realpath()' returns false, which coerces to '/' in string concatenation. Subsequent prefix checks with 'strpos()' or 'str_starts_with()' will match any absolute path startin
