Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
zelon88/HRCloud2
master @ 624434f
14
Fixes
0
CVEs
HIGH
Peak severity
46.2%
Coverage
Highlights
Path Traversal: 7 prior fixes. Scrutinize any change in this area.
commonCore.php: most-fixed (3 issues). Treat as high-risk during review.
13 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: The fix added '.' and '/' to a character blocklist for note names used in file_get_contents and unlink, but the same sanitization pattern was applied inconsistently across other components, indicating a systemic weakness in filename handling.
Path Traversal: User-supplied filenames in file_put_contents were sanitized for '../' sequences, but the fix also extended a dangerous-extension list, showing that filename validation must cover both traversal and file-type restrictions.
Path Traversal: Contact names were stripped of dots and slashes to prevent traversal in file_put_contents, unlink, and file_exists, but this per-component blocklist approach is fragile and easily missed in new components.