Description
The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter. NOTE: some of these details are obtained from third party information.
Remediation
References
Related Vulnerabilities
WordPress Plugin multi Scheduler Cross-Site Request Forgery (1.0.0)
TYPO3 Improper Restriction of XML External Entity Reference Vulnerability (CVE-2020-26229)
XWiki Improper Encoding or Escaping of Output Vulnerability (CVE-2022-36099)
WordPress Plugin Photospace Gallery Cross-Site Scripting (2.3.5)