AIKIDO-2026-961730

TL;DR

Slim's routing resolver decodes the request path before matching a route, then decodes the captured route arguments a second time before passing them to the application. This double percent-decoding lets doubly percent-encoded input reach handlers in a form the router never validated, bypassing route parameter constraints such as patterns that forbid path separators. An externally supplied value like %252F arrives at the handler decoded to /, defeating the constraint and enabling path traversal when the argument is used to build a file path. The fix stops decoding route arguments a second time and returns them exactly as the resolver already decoded them.