CVE-2026-43936

@@ -597,7 +597,12 @@ public function isUrlSafe($url)
 
 			foreach($ips as $ip)
 			{
-				if(!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE))
+				$canonical = $this->canonicalizeIp($ip);
+				if($canonical === false)
+				{
+					return false;
+				}
+				if(!filter_var($canonical, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE))
 				{
 					return false;
 				}
@@ -607,6 +612,33 @@ public function isUrlSafe($url)
 		}
 
 
+		/**
+		 * Canonicalize an IP for range validation. IPv4-mapped IPv6 addresses
+		 * (`::ffff:X.X.X.X`) are returned as their embedded IPv4 form so
+		 * `FILTER_FLAG_NO_RES_RANGE` evaluates the IPv4 ranges; PHP's filter
+		 * does not normalize the mapped form on its own, leaving
+		 * `::ffff:127.0.0.1` reachable as a loopback evasion.
+		 *
+		 * @param string $ip
+		 * @return string|false canonical IP, or false if the input is not an IP
+		 */
+		private function canonicalizeIp($ip)
+		{
+			$packed = @inet_pton($ip);
+			if($packed === false)
+			{
+				return false;
+			}
+
+			if(strlen($packed) === 16 && substr($packed, 0, 10) === str_repeat("\x00", 10) && substr($packed, 10, 2) === "\xff\xff")
+			{
+				return inet_ntop(substr($packed, 12, 4));
+			}
+
+			return $ip;
+		}
+
+
 		/**
 		 *     Grab a remote file and save it in the /temp directory. requires CURL
 		 *

@@ -539,6 +539,74 @@ public function getFileInfo($path_to_file, $imgcheck = true, $auto_fix_ext = tru
 		}
 
 
+		/**
+		 * Reject URLs that point at private/reserved IP ranges or non-HTTP(S) protocols.
+		 * Define `e_REMOTE_FILE_ALLOW_PRIVATE` to bypass for legitimate intranet use.
+		 *
+		 * @param string $url
+		 * @return bool
+		 */
+		public function isUrlSafe($url)
+		{
+			if(defined('e_REMOTE_FILE_ALLOW_PRIVATE') && e_REMOTE_FILE_ALLOW_PRIVATE === true)
+			{
+				return true;
+			}
+
+			$parts = parse_url($url);
+			if(empty($parts['host']))
+			{
+				return false;
+			}
+
+			$scheme = isset($parts['scheme']) ? strtolower($parts['scheme']) : '';
+			if($scheme !== 'http' && $scheme !== 'https')
+			{
+				return false;
+			}
+
+			$host = $parts['host'];
+			if($host[0] === '[' && substr($host, -1) === ']')
+			{
+				$host = substr($host, 1, -1);
+			}
+
+			$ips = array();
+			if(filter_var($host, FILTER_VALIDATE_IP))
+			{
+				$ips[] = $host;
+			}
+			else
+			{
+				$records = @dns_get_record($host, DNS_A | DNS_AAAA);
+				if(!is_array($records))
+				{
+					return false;
+				}
+				foreach($records as $r)
+				{
+					if(!empty($r['ip']))    { $ips[] = $r['ip']; }
+					if(!empty($r['ipv6']))  { $ips[] = $r['ipv6']; }
+				}
+			}
+
+			if(empty($ips))
+			{
+				return false;
+			}
+
+			foreach($ips as $ip)
+			{
+				if(!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE))
+				{
+					return false;
+				}
+			}
+
+			return true;
+		}
+
+
 		/**
 		 *     Grab a remote file and save it in the /temp directory. requires CURL
 		 *
@@ -563,6 +631,13 @@ function getRemoteFile($remote_url, $local_file, $type = 'temp', $timeout = 40)
 				return false;            // May not be installed
 			}
 
+			if(!$this->isUrlSafe($remote_url))
+			{
+				$this->error = 'Refused to fetch URL with non-HTTP(S) scheme or private/reserved IP: ' . $remote_url;
+				error_log($this->error);
+				return false;
+			}
+
 			$path = ($type === 'media') ? e_MEDIA : e_TEMP;
 
 			if($type === 'import')
@@ -620,6 +695,11 @@ public function initCurl($address, $options = null)
 			curl_setopt($cu, CURLOPT_REFERER, $referer);
 			curl_setopt($cu, CURLOPT_SSL_VERIFYPEER, false);
 			curl_setopt($cu, CURLOPT_FOLLOWLOCATION, true);
+			if(defined('CURLOPT_PROTOCOLS') && defined('CURLPROTO_HTTP') && defined('CURLPROTO_HTTPS'))
+			{
+				curl_setopt($cu, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+				curl_setopt($cu, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+			}
 			curl_setopt($cu, CURLOPT_USERAGENT, "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/81.0");
 			curl_setopt($cu, CURLOPT_COOKIEFILE, e_SYSTEM . 'cookies.txt');
 			curl_setopt($cu, CURLOPT_COOKIEJAR, e_SYSTEM . 'cookies.txt');
@@ -698,6 +778,12 @@ public function getRemoteContent($address, $options = array())
 
 			$address = str_replace(array("\r", "\n", "\t", '&'), array('', '', '', '&'), $address);
 
+			if(!$this->isUrlSafe($address))
+			{
+				$this->error = 'Refused to fetch URL with non-HTTP(S) scheme or private/reserved IP: ' . $address;
+				return false;
+			}
+
 			// ... and there shouldn't be unprintable characters in the URL anyway
 			$requireCurl = false;
 

@@ -586,6 +586,136 @@ public function testUnzipGithubArchive()
 		}
 	}
 
+	/**
+	 * Public addresses (real-world resolvable IPs and unbracketed/bracketed
+	 * IPv6) should be allowed through `e_file::isUrlSafe()`.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testIsUrlSafeAcceptsPublicAddresses()
+	{
+		$this->assertTrue($this->fl->isUrlSafe('http://1.1.1.1/'));
+		$this->assertTrue($this->fl->isUrlSafe('https://8.8.8.8/'));
+		$this->assertTrue($this->fl->isUrlSafe('http://93.184.216.34/'));
+		$this->assertTrue($this->fl->isUrlSafe('http://[2606:4700:4700::1111]/'));
+	}
+
+	/**
+	 * RFC 1918 ranges (10/8, 172.16/12, 192.168/16) are the canonical
+	 * SSRF-pivot targets and must be rejected.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testIsUrlSafeRejectsPrivateIPv4()
+	{
+		$this->assertFalse($this->fl->isUrlSafe('http://10.0.0.1/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://10.255.255.255/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://172.16.0.1/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://172.31.255.255/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://192.168.0.1/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://192.168.255.255/'));
+	}
+
+	/**
+	 * Reserved/loopback/link-local/broadcast IPv4 ranges, including the
+	 * AWS-style metadata endpoint at 169.254.169.254.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testIsUrlSafeRejectsReservedIPv4()
+	{
+		$this->assertFalse($this->fl->isUrlSafe('http://0.0.0.0/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://127.0.0.1/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://169.254.169.254/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://255.255.255.255/'));
+	}
+
+	/**
+	 * IPv6 loopback, ULA, link-local, and IPv4-mapped IPv6 forms must be
+	 * rejected. The IPv4-mapped case (`::ffff:127.0.0.1`) is a common
+	 * filter-evasion vector that PHP's FILTER_FLAG_NO_RES_RANGE catches.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testIsUrlSafeRejectsReservedIPv6()
+	{
+		$this->assertFalse($this->fl->isUrlSafe('http://[::1]/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://[fc00::1]/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://[fd00::dead:beef]/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://[fe80::1]/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://[::ffff:127.0.0.1]/'));
+	}
+
+	/**
+	 * Anything other than http(s) must be refused, even if the host would
+	 * otherwise pass the IP check. This stops file://, gopher://, dict://,
+	 * etc. before they ever reach cURL.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testIsUrlSafeRejectsNonHttpSchemes()
+	{
+		$this->assertFalse($this->fl->isUrlSafe('file:///etc/passwd'));
+		$this->assertFalse($this->fl->isUrlSafe('gopher://1.1.1.1/'));
+		$this->assertFalse($this->fl->isUrlSafe('ftp://1.1.1.1/'));
+		$this->assertFalse($this->fl->isUrlSafe('dict://1.1.1.1/'));
+		$this->assertFalse($this->fl->isUrlSafe('javascript:alert(1)'));
+	}
+
+	/**
+	 * Empty, schemeless, hostless, or otherwise unparseable URLs should be
+	 * rejected without making any network call.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testIsUrlSafeRejectsMalformedUrls()
+	{
+		$this->assertFalse($this->fl->isUrlSafe(''));
+		$this->assertFalse($this->fl->isUrlSafe('not-a-url'));
+		$this->assertFalse($this->fl->isUrlSafe('http:///path-only'));
+		$this->assertFalse($this->fl->isUrlSafe('//1.1.1.1/'));
+	}
+
+	/**
+	 * Decimal/hex/octal-encoded IPv4 forms (e.g. `2130706433` for
+	 * 127.0.0.1) bypass FILTER_VALIDATE_IP because they aren't dotted
+	 * quads. They then fail dns_get_record (no valid A/AAAA record),
+	 * so the no-IPs-found branch rejects them.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testIsUrlSafeRejectsObfuscatedAddresses()
+	{
+		$this->assertFalse($this->fl->isUrlSafe('http://2130706433/'));
+		$this->assertFalse($this->fl->isUrlSafe('http://0x7f000001/'));
+	}
+
+	/**
+	 * `getRemoteFile()` should refuse SSRF candidates without making any
+	 * cURL call and surface a meaningful error message.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testGetRemoteFileRejectsUnsafeUrl()
+	{
+		$result = $this->fl->getRemoteFile('http://127.0.0.1/foo.jpg', 'foo.jpg');
+		$this->assertFalse($result);
+		$this->assertStringContainsString('private/reserved IP', $this->fl->getErrorMessage());
+	}
+
+	/**
+	 * `getRemoteContent()` should refuse SSRF candidates without making
+	 * any cURL call and surface a meaningful error message.
+	 *
+	 * Ref: GHSA-92fr-7h4f-22pp.
+	 */
+	public function testGetRemoteContentRejectsUnsafeUrl()
+	{
+		$result = $this->fl->getRemoteContent('http://10.0.0.1/');
+		$this->assertFalse($result);
+		$this->assertStringContainsString('private/reserved IP', $this->fl->getErrorMessage());
+	}
+
 	/*
 	public function testGetRootFolder()
 	{