CMS Made Simple Forums

The filemanager allows directory traversals and therefore everybody with the permissions to modify files can upload files outside the upload-directory.

Steps to reproduce:
1. (optional) Create User with permission to modify files but without permission for the "Advanced usage of the the File Manager module".
2. Go to the filemanager, upload files
3. Manipulate the hidden field <input id="m1_path" name="m1_path"> to contain for example the path /uploads/../../
4. Upload a file

I can't repoduce on SVN rev. 7361

But I can't change folders in FM anymore.
Perhaps the result of fixing this issue??

Rolf

Should be fixed in SVN rev. 7361