• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

The template manager reads the file to act on from the base64 file request parameter and builds an absolute path from it. save(), deleteFile(), renameFile() and copyFile() pass that path to File::write / File::delete / rename / File::copy after only Path::clean(), which normalizes separators but leaves .. intact. The read path getSource() already runs the same value through Path::check(); these mutating methods now do the same, so a file value that decodes to a ../ sequence is rejected instead of resolving outside the template directory.

Testing Instructions

Log in to the backend as a user with template edit rights and open a template in Templates: Customise. Capture the template.save (or the deleteFile / renameFile / copyFile task) request and set the file parameter to Li4vLi4vLi4vLi4vdG1wL3gucGhw (base64 of ../../../../tmp/x.php), which passes the cmd input filter unchanged.

Actual result BEFORE applying this Pull Request

The request writes, deletes, renames or copies a file outside the active template directory.

Expected result AFTER applying this Pull Request

The operation is refused and the target stays contained to the template directory, matching how getSource() already validates the read path.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed