admin/cacti
1
0 Fork 0
mirror of https://github.com/Cacti/cacti.git synced 2026-10-23 19:47:06 +09:00
Code Issues Packages Projects Releases Wiki Activity

security: escape executable path in exec_background on non-win32 (GHSA-cv7j-p6fh-j4q7)

Browse Source
This commit is contained in:
TheWitness committed 2026-09-24 06:36:42 -04:00
1 parent 32ffb0851a
commit 5fbe90fb4a
1 file changed
+9 -2
Download Patch File Download Diff File Expand all files Collapse all files
lib/poller.php
+9 -2
View File
@@ -150,9 +150,16 @@ function exec_background(string $filename, string|array $args = '', string|array
pclose(popen('start "Cactiplus" /I ' . $filename . ' ' . $args . ' ' . $redirect_args, 'r'));
}
} elseif ($redirect_args == '') {
exec($filename . ' ' . $args . ' > /dev/null 2>&1 &');
// filename is user-influenced (e.g. a configured PHP/script binary
// path) and was passed to the shell unescaped on non-win32; escape
// it like every other argument here.
$safe_filename = cacti_escapeshellarg($filename);
exec($safe_filename . ' ' . $args . ' > /dev/null 2>&1 &');
} else {
exec($filename . ' ' . $args . ' ' . $redirect_args . ' &');
$safe_filename = cacti_escapeshellarg($filename);
exec($safe_filename . ' ' . $args . ' ' . $redirect_args . ' &');
}
}
} else {