Description
session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
Remediation
References
Related Vulnerabilities
WordPress 5.1.x Multiple Vulnerabilities (5.1 - 5.1.10)
WordPress Plugin myLinksDump 'url' Parameter SQL Injection (1.2)
WordPress Plugin UserPro-Community and User Profile Cross-Site Scripting (4.9.23)
Joomla! Core 3.x.x Information Disclosure (3.0.0 - 3.9.19)
WordPress Plugin Broken Link Checker PHAR Deserialization (1.11.16)