{"action":"closed","issue":{"url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1060","labels_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1060/labels{/name}","comments_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1060/comments","events_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/issues/1060/events","html_url":"https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1060","id":88787400,"number":1060,"title":"file upload security bypass, using whitelist and mime checking","user":{"login":"tablatronix","id":807787,"avatar_url":"https://avatars.githubusercontent.com/u/807787?v=3","gravatar_id":"","url":"https://api.github.com/users/tablatronix","html_url":"https://github.com/tablatronix","followers_url":"https://api.github.com/users/tablatronix/followers","following_url":"https://api.github.com/users/tablatronix/following{/other_user}","gists_url":"https://api.github.com/users/tablatronix/gists{/gist_id}","starred_url":"https://api.github.com/users/tablatronix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tablatronix/subscriptions","organizations_url":"https://api.github.com/users/tablatronix/orgs","repos_url":"https://api.github.com/users/tablatronix/repos","events_url":"https://api.github.com/users/tablatronix/events{/privacy}","received_events_url":"https://api.github.com/users/tablatronix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/labels/Bug","name":"Bug","color":"D01314"},{"url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/labels/SECURITY","name":"SECURITY","color":"FF0000"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/milestones/13","html_url":"https://github.com/GetSimpleCMS/GetSimpleCMS/milestones/3.3.6","labels_url":"https://api.github.com/repos/GetSimpleCMS/GetSimpleCMS/milestones/13/labels","id":1063822,"number":13,"title":"3.3.6","description":"","creator":{"login":"tablatronix","id":807787,"avatar_url":"https://avatars.githubusercontent.com/u/807787?v=3","gravatar_id":"","url":"https://api.github.com/users/tablatronix","html_url":"https://github.com/tablatronix","followers_url":"https://api.github.com/users/tablatronix/followers","following_url":"https://api.github.com/users/tablatronix/following{/other_user}","gists_url":"https://api.github.com/users/tablatronix/gists{/gist_id}","starred_url":"https://api.github.com/users/tablatronix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tablatronix/subscriptions","organizations_url":"https://api.github.com/users/tablatronix/orgs","repos_url":"https://api.github.com/users/tablatronix/repos","events_url":"https://api.github.com/users/tablatronix/events{/privacy}","received_events_url":"https://api.github.com/users/tablatronix/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":15,"state":"open","created_at":"2015-04-12T16:24:16Z","updated_at":"2015-06-22T21:07:32Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-06-16T17:18:17Z","updated_at":"2015-06-22T21:07:32Z","closed_at":"2015-06-22T21:07:32Z","body":"> reported by tc.coen\r\n\r\n```\r\nCode Execution (Admin, not with default config)\r\nRisk\r\nMinimal\r\n\r\nDescription\r\nCurrently, this is the function that validates that no invalid files (such as PHP files) are uploaded:\r\n\r\nThis function works fine with default configuration, because the whitelist is not used. But if a user were to use the whitelist approach (because whitelists are safer than blacklists), this would actually be vulnerable, as it would then rely on the given mime type, which is entirely user controlled.\r\n```\r\n\r\nI am going to disable all mime checking for uploads, and fix minor issues with whitelist checking.\r\n"}}