Description
This script is vulnerable to arbitrary file creation.
This issue allows an attacker to influence calls to functions which create files/directories and create arbitrary files. Due to a lack of input validation, an attacker can supply directory traversal sequences followed by an arbitrary file name to create specific files.
Remediation
Your script should filter metacharacters from user input.
References
Related Vulnerabilities
SugarCRM Improper Input Validation Vulnerability (CVE-2017-14509)
WordPress Improper Input Validation Vulnerability (CVE-2019-20041)
IBM WebSEAL Improper Input Validation Vulnerability (CVE-2020-4461)
PHP Improper Input Validation Vulnerability (CVE-2008-3660)
WordPress Plugin Magn WP Drag and Drop Upload Arbitrary File Upload (1.1.4)