| Title | phpMyAdmin MoTranslator 6.0.1 Path Traversal in Loader::getTranslator (CWE-22) |
|---|
| Description | phpMyAdmin MoTranslator is prone to a path traversal (CWE-22) in
Loader::getTranslator().
Loader::listLocales() returns non-POSIX locale strings verbatim:
if (! in_array($locale, $localeNames, true)) {
$localeNames[] = $locale;
}
Loader::getTranslator() then concatenates that string into a
filesystem path without any containment check:
$filename = $base . '/' . $locale . '/LC_MESSAGES/' . $domain . '.mo';
if (file_exists($filename)) { break; }
The OS collapses every ".." component during path resolution. A locale
string such as "../evil" resolves outside $base, and the .mo file
found there is parsed and cached. Its translations are returned by
Translator::gettext().
Reproducer: 4 traversal shapes, all confirmed against
motranslator-master/src/Loader.php on PHP 8.5.10. Full chain trace,
variant suite, and proposed fix are in the public gist.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Base Score: 5.4 (Medium)
Impact: attacker-controlled translation strings (spoofing, phishing,
conditional XSS if the consuming application renders translations
without escaping). Not RCE, not arbitrary file read. |
|---|
| Source | ⚠️ https://gist.github.com/Ishanoshada/42eb6d8737aef38e133afb04fd2e52e8 |
|---|
| User | ishanoshada (UID 101910) |
|---|
| Submission | 10/07/2026 15:30 (27 days ago) |
|---|
| Moderation | 11/03/2026 11:48 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 430229 [phpMyAdmin MoTranslator up to 6.0.1 Loader.php Loader::getTranslator locale path traversal] |
|---|
| Points | 20 |
|---|