CVE-2026-104081: Php Single Pass Traversal Strip Path Traversal
A single non-recursive str_replace() pass is used to strip '../' or '..\' from a path or archive entry name. One pass is not idempotent: crafted names such as "....//" lose their inner "../" and the residual ".." + "/" re-splice into a live "../", so the "sanitized" path still escapes the extraction directory (Zip Slip) and enables arbitrary file overwrite,
PHPgreprules fetch cve-2026-104081-php-single-pass-traversal-strip-path-traversal --engine opengrepDescription
A single non-recursive str_replace() pass is used to strip '../' or '..\' from a path or archive entry name. One pass is not idempotent: crafted names such as "....//" lose their inner "../" and the residual ".." + "/" re-splice into a live "../", so the "sanitized" path still escapes the extraction directory (Zip Slip) and enables arbitrary file overwrite,
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.