Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter

// build/shortpixel/filesystem/src/Model/File/DirectoryModel.php

  public function __construct($path)
  {
   //   $path = wp_normalize_path($path);
      $fs = $this->getFS();

      if ($fs->pathIsUrl($path))
      {
        $pathinfo = pathinfo($path);
        if (isset($pathinfo['extension'])) // check if this is a file, remove the file information.
        {
          $path = $pathinfo['dirname'];
        }

        $this->is_virtual = true;
        $this->is_readable = true; // assume
        $this->exists = true;
      }

      if (! $this->is_virtual() && ! is_dir($path) ) // path is wrong, *or* simply doesn't exist.
      {
        /* Test for file input. */
        $pathinfo = pathinfo($path);

        if (isset($pathinfo['extension']))
        {
          $path = $pathinfo['dirname'];
        }
        elseif (is_file($path))
          $path = dirname($path);
      }

      if (! $this->is_virtual() && ! is_dir($path))
      {
        $testpath = realpath($path);
        if ($testpath)
          $path = $testpath;
      }

      // The path is normalized and trailingslashed, but not sanitized for HTML/Script tags.
      $this->path = trailingslashit($path);

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/enable-media-replace/4.1.8/build/shortpixel/filesystem/src/Model/File/DirectoryModel.php /home/deploy/wp-safety.org/data/plugin-versions/enable-media-replace/4.1.9/build/shortpixel/filesystem/src/Model/File/DirectoryModel.php
--- /home/deploy/wp-safety.org/data/plugin-versions/enable-media-replace/4.1.8/build/shortpixel/filesystem/src/Model/File/DirectoryModel.php	2022-11-23 09:41:32.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/enable-media-replace/4.1.9/build/shortpixel/filesystem/src/Model/File/DirectoryModel.php	2026-04-22 16:33:10.000000000 +0000
@@ -20,6 +20,7 @@
   protected $is_writable = null;
   protected $is_readable = null;
   protected $is_virtual = null;
+  protected $is_restricted = false;
 
   protected $fields = array();
 
@@ -48,7 +49,21 @@
         $this->exists = true;
       }
 
-      if (! $this->is_virtual() && ! is_dir($path) ) // path is wrong, *or* simply doesn't exist.
+      if( false == $this->is_virtual() && true === $this->fileIsRestricted($path) )
+      {
+         $this->exists = false;
+         $this->is_readable = false;
+         $this->is_writable = false;
+         $this->is_restricted = true;
+      }
+      else {
+        $this->is_virtual = false;
+      }
+
+      if (false === $this->is_virtual() &&
+          false === $this->is_restricted &&
+          false === is_dir($path)
+          ) // path is wrong, *or* simply doesn't exist.
       {
         /* Test for file input.
         * If pathinfo is fed a fullpath, it rips of last entry without setting extension, don't further trust.
@@ -64,7 +79,10 @@
           $path = dirname($path);
       }
 
-      if (! $this->is_virtual() && ! is_dir($path))
+      if (false === $this->is_virtual() &&
+          false === $this->is_restricted &&
+          false === is_dir($path)
+          ) // path is wrong, *or* simply doesn't exist.
       {
         /* Check if realpath improves things. We support non-existing paths, which realpath fails on, so only apply on result.
         Moved realpath to check after main pathinfo is set. Reason is that symlinked directories which don't include the WordPress upload dir will start to fail in file_model on processpath ( doesn't see it as a wp path, starts to try relative path). Not sure if realpath should be used anyhow in this model /BS
@@ -224,6 +242,37 @@
 
   }
 
+  /** Check if path is allowed within openbasedir restrictions. This is an attempt to limit notices in file funtions if so.  Most likely the path will be relative in that case.
+  * @param String Path as String
+  */
+  private function fileIsRestricted($path)
+  {
+
+     $basedir = ini_get('open_basedir');
+
+     if (false === $basedir || strlen($basedir) == 0)
+     {
+         return false;
+     }
+
+     $restricted = true;
+     $basedirs = preg_split('/:|;/i', $basedir);
+
+     foreach($basedirs as $basepath)
+     {
+          if (strpos($path, $basepath) !== false)
+          {
+             $restricted = false;
+             break;
+          }
+     }
+
+     // Allow this to be overridden due to specific server configs ( ie symlinks ) might get this flagged falsely.
+     $restricted = apply_filters('emr/file/basedir_check', $restricted);
+
+     return $restricted;
+  }
+
 
   /* Last Resort function to just reduce path to various known WorPress paths. */
   private function constructUsualDirectories($path)
@@ -484,6 +533,10 @@
       $path = $this->getPath();
       $parentPath = dirname($path);
 
+      if ($path === $parentPath)
+      {
+         return false;
+      }
       $parentDir = new DirectoryModel($parentPath);
 
       return $parentDir;