Description
PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.
Remediation
References
Related Vulnerabilities
Mailman Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2021-44227)
Plone CMS URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2016-7137)
MongoDb Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2021-20326)
WordPress Cross-Site Scripting Vulnerability (3.9.3 - 4.2)
Oracle Database Server CVE-2014-6541 Vulnerability (CVE-2014-6541)