Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter

// includes/ee-functions.php line 1262
	// Check if we should be doing this
	if(!is_admin() AND $eeSFL->eeListSettings['AllowFrontManage'] != 'YES') {
		eeSFL_Debug_Log("ERROR: Front manage not allowed", 'Admin', $eeSFL->eeListID);
		return;
	}

// ... 

// includes/ee-functions.php line 1288
	$eeSubFolder = FALSE;
	if( isset($_POST['eeSubFolder']) && !empty($_POST['eeSubFolder']) ) {
		$eeSubFolderRaw = sanitize_text_field(wp_unslash($_POST['eeSubFolder']));
		$eeSubFolder = urldecode($eeSubFolderRaw);
	}

---

// includes/ee-functions.php line 894
	// Path construction
	$eeFilePath = eeSFL_WP_ROOT . $eeSFL->eeListSettings['FileListDir'] . $eeSubFolderPath . $eeFileName;
	eeSFL_Debug_Log("DELETE: Full path: '$eeFilePath'", 'FileOps', $eeSFL->eeListID);

	$eeMessages[] = $eeSFL->eeListSettings['FileListDir'] . $eeFileName;

	// Check if it's a file
	if( eeSFL_FileSystem('is_file', array('file' => $eeFilePath))['data'] ) {
		$eeSFL_Result = eeSFL_FileSystem('delete', array('file' => $eeFilePath));

--- /home/deploy/wp-safety.org/data/plugin-versions/simple-file-list/6.3.7/includes/ee-functions.php	2026-06-09 18:19:22.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/simple-file-list/6.3.8/includes/ee-functions.php	2026-06-19 18:45:06.000000000 +0000
@@ -882,11 +882,9 @@
 	global $eeSFL, $eeSFLF;
 
 	eeSFL_Debug_Log("DELETE: Starting delete operation for '$eeFileName'", 'FileOps', $eeSFL->eeListID);
-	eeSFL_Debug_Log("DELETE: Subfolder received: " . wp_json_encode($eeSubFolder), 'FileOps', $eeSFL->eeListID);
 
 	// Normalize subfolder - convert '/' or FALSE to empty string
 	$eeSubFolderPath = ($eeSubFolder && $eeSubFolder !== '/') ? $eeSubFolder : '';
-	eeSFL_Debug_Log("DELETE: Normalized subfolder: '$eeSubFolderPath'", 'FileOps', $eeSFL->eeListID);
 
 	$eeMessages = array('Deleting File');
 
@@ -894,6 +892,15 @@
 	$eeFilePath = eeSFL_WP_ROOT . $eeSFL->eeListSettings['FileListDir'] . $eeSubFolderPath . $eeFileName;
 	eeSFL_Debug_Log("DELETE: Full path: '$eeFilePath'", 'FileOps', $eeSFL->eeListID);
 
+	// Confinement check — ensure the resolved path stays within the list directory.
+	// Guards against path traversal in both $eeSubFolder (Pro) and $eeFileName.
+	$eeBaseDir = realpath(eeSFL_WP_ROOT . $eeSFL->eeListSettings['FileListDir']);
+	$eeRealPath = realpath($eeFilePath);
+	if( $eeBaseDir && $eeRealPath && strpos($eeRealPath, $eeBaseDir) !== 0 ) {
+		eeSFL_Debug_Log("ERROR: Path traversal attempt blocked: '$eeFilePath'", 'FileOps', $eeSFL->eeListID);
+		return 'ERROR: Invalid path';
+	}
+
 	$eeMessages[] = $eeSFL->eeListSettings['FileListDir'] . $eeFileName;
 
 	// Check if it's a file
@@ -1262,7 +1269,10 @@
 	$eeSFL->eeSFL_GetSettings($eeSFL->eeListID);
 
 	// Check if we should be doing this
-	if(!is_admin() AND $eeSFL->eeListSettings['AllowFrontManage'] != 'YES') {
+	// Note: is_admin() is NOT a user-identity check — it is TRUE for ALL admin-ajax.php requests,
+	// including unauthenticated nopriv ones. Use current_user_can() for authorization.
+	// When AllowFrontManage = YES the gate is intentionally open to all page visitors (by design).
+	if( !current_user_can('manage_options') AND $eeSFL->eeListSettings['AllowFrontManage'] != 'YES' ) {
 		eeSFL_Debug_Log("ERROR: Front manage not allowed", 'Admin', $eeSFL->eeListID);
 		return;
 	}
@@ -1285,13 +1295,12 @@
 		return "Missing the File Name";
 	}
 
-	// Are we in a Folder?
+	// Subfolder support is a Pro feature — the free version always operates on the root directory.
+	// The eeSubFolder POST parameter is intentionally ignored here to eliminate the path traversal
+	// attack surface entirely (CVE-2026-11911). Pro: apply path traversal sanitization wherever
+	// eeSubFolder is read from POST — strip ../ sequences and validate the resolved path stays
+	// within FileListDir using realpath() before passing to eeSFL_DeleteFile() / eeSFL_RenameFile().
 	$eeSubFolder = FALSE;
-	if( isset($_POST['eeSubFolder']) && !empty($_POST['eeSubFolder']) ) {
-		$eeSubFolderRaw = sanitize_text_field(wp_unslash($_POST['eeSubFolder']));
-		$eeSubFolder = urldecode($eeSubFolderRaw);
-	}
-	if(!$eeSubFolder OR $eeSubFolder == '/') { $eeSubFolder = FALSE; }