Why are double-periods (“..”) invalid in a WordPress image filename?

Looks like this is a defect. Ish.

As @s_ha_dum mentioned, this is to prevent a directory traversal attack. However, WordPress’ Media Library will happily let you upload a file with two or more periods in a row, even if ms-files.php will refuse to serve it up.

So, nothing is technically “broken”, but this certainly isn’t ideal. There’s a patch to prevent this, but it looks like it was never actually added to the core:

https://core.trac.wordpress.org/attachment/ticket/16189/check%20for%20double%20periods.diff

More info on this defect:
https://core.trac.wordpress.org/ticket/12756

Related Posts:

  1. Storing WordPress Media Library Uploaded files onto a separate domain
  2. How to show all available images in WP’s media library when using the Polylang plugin?
  3. Media upload finished hook
  4. Users can’t upload images on frontend if they haven’t got access to the wp backend
  5. How can I batch delete all unattached images with WP-CLI or other automated process?
  6. Which filters or actions to use after a media upload and delete?
  7. Protecting direct access to PDF and ZIP unless user logged in (without plugin)
  8. How to wp_upload_bits() to a sub-folder?
  9. How to restrict images in v3.5 Media Library modal to only those from a specific post id?
  10. “Add Media” only shows “Full Size” under Attachment Display Settings
  11. Where do the favicons for Media Files come from
  12. What might cause a POST to wp-admin/async-upload.php to return JSON >and< HTML?
  13. Is it possible to trigger some JavaScript when Media Popup is opened?
  14. How can I speed up a slow loading media library?
  15. What to do with unattached logos and header uploaded via native wordpress uploader?
  16. Append button to WordPress Image Details modal
  17. Add item to media library from blob or dataUrl
  18. add_image_size creating lots of images (of various sizes)
  19. WP3.5 Media Uploader – how to make it accept multiple images?
  20. Restrict file uploads by extension?
  21. Add new media uploader at frontend for wp 3.5+
  22. Trying to add filename over image in Media Browser
  23. Plugin to Import Dropbox Files into Media Folder from the Cloud [closed]
  24. How to disable WordPress Media resize different size version?
  25. Media library storing files in uploads not folders within in uploads
  26. Is there a limit on the number of attachments?
  27. How to host different file formats/types for a media attachment without creating multiple attachments?
  28. WordPress won’t generate image sizes for certain images
  29. Resize the WP media Uploader iFrame
  30. Site icons with alpha channel for self-hosted WordPress blog network
  31. how to use media library [closed]
  32. Can I stop wordpress generating media sizes
  33. Cannot upload .mp3 file to wordpress media
  34. Replacing Images in Media Library
  35. How to upload unknown file type?
  36. Custom “Insert into Post” button
  37. How to use MediaUpload outside of editor
  38. Switch between tabs on “Insert Media” dialog
  39. Restrict WordPress Media Library for a specific user role (users can only see/select own media)
  40. WordPress auto generates small medium and large of an image on upload, how can we guess their links?
  41. Prevent a folder from being shown within the media library
  42. Is It Possible to Upload Certain Attachment Files To A Remote Server
  43. Error uploading image in WordPress
  44. Stop WordPress from generating redundant image size
  45. WordPress 4.9.8 Trying to add filename over image in Media Browser
  46. WordPress Issue : The uploaded file could not be moved to wp-content/uploads/
  47. Convert (-) and (escape) signs to (_) when uploading files on wordpress media library automatically
  48. wordpress media upload given An error occurred in the upload. Please try again later
  49. After moving from complete AWS setup to a standalone WordPress Server, Media/Image Files are Broken
  50. Using wp_enqueue_media() with switch_to_blog() issue
  51. Duplicates and other problems in Media Library
  52. How to get the return value of wp.media({ frame: ‘post’ }) in all cases?
  53. WordPress Media frame pre load images from ids
  54. Media library only shows for admin. Doesn’t show editor or below [closed]
  55. Choosing images size when uploading
  56. Multi Upload In Theme Options
  57. Resize existing library images
  58. Media Library Won’t Display Any Images
  59. upload_max_filesize in .user.ini Not Reflected in Media Upload
  60. A link (not in the post) to download a specific PDF file
  61. How to change format of file link ( Name ) when insert from media uploder
  62. More Fields & Media Upload
  63. How does wordpress handle media files?
  64. Set different max upload size limits based on file type/extension
  65. Correctly using the root directory for media uploads?
  66. Organizing uploaded Media in permalink-based folder structure?
  67. Offload Media Library to other domain on a different server
  68. How to allow .bin files upload?
  69. What is the URL pattern for image thumbnails + sizes?
  70. Changing titles in Uploader for “Posts”
  71. Add SWF file to wordpress through custom template
  72. How to detect when a file has been uploaded?
  73. Uploaded images result in a file url with full path on disk appended
  74. Multiple images are generated in WP-content in wordpress
  75. Removing extra large generated images disables all crops
  76. MIME types not recognized by media library
  77. Restrict Users to Only Edit Media Owned by Users in Their Role
  78. Images not displaying on site or media library
  79. Replicate Media Galley Edit view in Add Media View
  80. Front-End Upload media with category
  81. Images uploaded via Gutenberg image block are cropped
  82. Bulk upload images in upload folder does not show in media library
  83. Media not displaying other users uploads – WordPress 4.9.2
  84. Redimension thumbnail crop without creating new images
  85. Issues with WordPress 3.9.6 media libraries on XAMPP
  86. Upload Multiple Files With Multiple Fields And With media_handle_upload
  87. Private file system for attachments
  88. controlling whether upload is attached to post or not
  89. How to split my uploaded media into directories?
  90. Metabox with file upload to custom directory
  91. Attachment Metadata not updated while uploading audio files
  92. Is there a way to force Featured image to show as attachement?
  93. Link or button to open the media manager from frontend
  94. Problem uploading files, after changing domain name
  95. Unable to upload images using the Media Library
  96. Bring up the media uploader on click
  97. How can comments be turned off for media attachments on WordPress?
  98. Question regarding the file path for media_sideload_image and wp_upload_dir()
  99. How do I restore attachment from files in wp-upload
  100. Image in binary in the data to WordPress media library

Leave a Comment

error code: 523