Comment # 20 on bug 994313 from Marcus Meissner

https://www.phpmyadmin.net/security/PMASA-2016-37/

PMASA-2016-37

Announcement-ID: PMASA-2016-37

Date: 2016-07-12
Summary

Path traversal with SaveDir and UploadDir
Description

A vulnerability was reported with the %u username replacement functionality of
the SaveDir and UploadDir features. When the username substitution is
configured, a specially-crafted user name can be used to circumvent
restrictions to traverse the file system.
Severity

We consider this vulnerability to be serious, however due to the mitigation
factors the default state is not vulnerable.
Mitigation factor

1) A system must be configured with the %u username replacement, such as
`$cfg['SaveDir'] = 'SaveDir_%u';` 2) The user must be able to create a
specially-crafted MySQL user, including the `/.` sequence of characters, such
as `/../../`
Affected Versions

All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and
4.0.x versions (prior to 4.0.10.17) are affected
Solution

Upgrade to phpMyAdmin 4.6.4, 4.4.15.8, or 4.0.10.17 or newer or apply patch
listed below.
References

Thanks to Emanuel Bronshtein @e3amn2l for reporting this vulnerability.

Assigned CVE ids: CVE-2016-6614

CWE ids: CWE-661
Patches

The following commits have been made on the 4.0 branch to fix this issue:

    c6cfb58

The following commits have been made on the 4.4 branch to fix this issue:

    2989e49

The following commits have been made on the 4.6 branch to fix this issue:

    5491d67