Security context

Highlights

Path Traversal: 1 prior fix. Scrutinize any change in this area.

src/EventListener/Doctrine/CleanListener.php: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Unrestricted Upload of File with Dangerous Type: Client-controlled filename extension was trusted for determining stored file extension, allowing polyglot files to be saved with executable extensions and enabling RCE.

Path Traversal: Cleanup used the current entity filename value, which can be attacker-controlled, to delete files, enabling arbitrary file deletion via path traversal.