AIKIDO-2026-501569

TL;DR

The HTTP session component takes the session id directly from the client-supplied sid cookie, and its id validator was inert because it compared the preg_match result with !== false, so the allowlist accepted every string including path separators and .. segments. The default file-based session handler then built the on-disk path by concatenating that value without basename or realpath containment. An unauthenticated request carrying a crafted sid cookie therefore writes the serialized session outside the configured session directory, creating missing parent directories, which can escalate to remote code execution when session content is attacker-influenced and enables session fixation. The fix compares the match result with === 1 to reject invalid ids and wraps the id in basename as defense in depth.