CVE-2025-14675

@@ -51,8 +51,17 @@ public static function ajax_delete_file() {
 		if ( is_numeric( $attachment ) ) {
 			$result = wp_delete_attachment( $attachment );
 		} else {
-			$path   = str_replace( home_url( '/' ), trailingslashit( ABSPATH ), $attachment );
-			$result = unlink( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
+			$path = str_replace( home_url( '/' ), trailingslashit( ABSPATH ), $attachment );
+
+			// Security: validate resolved path is within $field['upload_dir'] directory.
+			$real_path    = realpath( $path );
+			$real_path    = wp_normalize_path( $real_path );
+			$allowed_base = ! empty( $field['upload_dir'] ) ? wp_normalize_path( $field['upload_dir'] ) : '';
+			if ( ! $real_path || ! $allowed_base || ! str_starts_with( $real_path, $allowed_base ) ) {
+				wp_send_json_error( __( 'Error: The file is outside the allowed upload directory', 'meta-box' ) );
+			}
+
+			$result = unlink( $real_path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink
 		}
 
 		if ( $result ) {

@@ -205,7 +205,14 @@ private function sanitize_text( $value ) {
 	 * @return array
 	 */
 	private function sanitize_file( $value, $field ) {
-		return $field['upload_dir'] ? array_map( 'esc_url_raw', $value ) : $this->sanitize_object( $value );
+		if ( ! $field['upload_dir'] ) {
+			return $this->sanitize_object( $value );
+		}
+
+		// Security: sanitize URLs and reject path traversal sequences.
+		return array_filter( array_map( function ( $url ) {
+			return str_contains( $url, '..' ) ? '' : esc_url_raw( $url );
+		}, $value ) );
 	}
 
 	/**