CVE-2026-114622: Php Basercms Path Traversal Decode After Validatecve-2026-114622-php-basercms-path-traversal-decode-after-validate
Filesystem operation consumes a URL-decoded path (rawurldecode/urldecode in a path argument). Percent-encoded traversal (e.g. '%2e%2e%2f') contains no literal dot segments, so any containment check performed on the still-encoded value passes and the decode at the sink resolves the path outside the intended directory (check-before-decode, CWE-180/CWE-179). De
