b4fbd46cc1b9e319f88748d7ac46d0677be43e75
extract_payload_from_archive() relied entirely on tar's own default path-traversal protection when extracting a DirectAdmin restore archive to locate the plugin's backup/alt_mysql payload. Explicitly inspect the archive listing first and refuse to extract at all if any member has an absolute path or a ".." segment, rather than trusting that the wildcard extraction pattern happens to filter out an unsafe member.
Description
No description provided
Languages
PHP
56.5%
Shell
39.2%
CSS
4.3%