CVE-2015-4598

PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not
ensure that pathnames lack %00 sequences, which might allow remote
attackers to read or write to arbitrary files via crafted input to an
application that calls (1) a DOMDocument save method or (2) the GD
imagepsloadfont function, as demonstrated by a filename\0.html attack that
bypasses an intended configuration in which client users may write to only
.html files.

Bugs

• <https://bugs.php.net/bug.php?id=69719&gt;