CVE-2021-41714

An authenticated user sends a crafted HTTP request to the attachment download endpoint, supplying a path traversal payload (e.g., `../../../.env`) in the `image_name` parameter. Because the application does not strip `..` sequences before constructing the file path, the server reads and returns files outside the intended storage directory. This allows the attacker to leak sensitive files such as `.env`, `/etc/passwd`, or `laravel.log`. [ref_id=1]

The vulnerability resides in the `avatar()` and `show()` methods of the `ImageController` class in Tipask. The `show()` method passes user-supplied `$image_name` directly into `storage_path()` without sanitizing path traversal sequences (`..`), allowing an authenticated user to read arbitrary files on the server. The `avatar()` method had the same flaw in the `$avatar_name` parameter. [ref_id=1]

The patch adds `$fileName = str_replace("..","",$image_name);` (and the equivalent for `avatar_name`) to strip directory traversal sequences from user input before it is used to build the file path. This prevents an attacker from escaping the intended storage directory. The same sanitization is applied to the watermark check to ensure the comparison uses the cleaned filename. [ref_id=1]