[#48381] - [5.4] Escape archive entry names in the template file manager preview
- Fixed in Code Base
- 21 Oct 2026
- Medium
- Build: 5.4-dev
- # 48381
- Diff
- XananasX7:security/escape-archive-entry-names
User tests: Successful: Unsuccessful:
Pull Request resolves #
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
The archive preview in the Template Manager file view (the panel shown when a ZIP file is selected in the file tree, before using "Extract Here") prints the names of the archive entries without escaping:
<span class="icon-file icon-fw" aria-hidden="true"></span> <?php echo $file; ?>Entry names of an uploaded ZIP are not trustworthy. A crafted archive can contain entry names with HTML markup, and those names are rendered in the administrator interface as soon as the ZIP is selected for inspection. Every other name rendered in this view (folder names, file names) already goes through $this->escape(); only the archive entry names were missing it.
This PR escapes the archive entry names with $this->escape(), consistent with the rest of the view.
Note: the same unescaped output exists in the 6.1-dev and 7.0-dev branches and should be ported there as well.
Testing Instructions
Create a ZIP whose entry names contain markup. The upload check scans only the first 256 bytes of the file for HTML tags, so the payload entry has to be placed after a longer first entry:
$zip = new ZipArchive();
$zip->open('demo.zip', ZipArchive::CREATE | ZipArchive::OVERWRITE);
$zip->addFromString(str_repeat('a', 300) . '.txt', 'padding');
$zip->addFromString('<script>window.__xss=1</script>.txt', 'payload');
$zip->close();- In the backend go to Content → Site Templates and open a template (e.g. Cassiopeia) to get to the Templates: Customise file view.
- In the file tree on the left select a folder of that template.
- Click New File in the toolbar and use the Upload form to upload
demo.zip. - Select
demo.zipin the file tree. The archive preview lists its entries.
Actual result BEFORE applying this Pull Request: the entry name <script>window.__xss=1</script>.txt is inserted into the page as raw markup (view page source to confirm).
Expected result AFTER applying this Pull Request: the entry name is displayed as plain text, escaped like the folder and file names in the same view.
Link to documentations
- No documentation changes for guide.joomla.org needed
- No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | Administration com_templates |
I have tested this item ✅ successfully on 360d644
Tested with JBT and ZIP-archive created as test instruction given.
- Before PR seen file is shown as
.txtin File Content Preview and HTML source code contains<script>window.__xss=1</script> - Applied PR with Patch Tester and file name is shown as
<script>window.__xss=1</script>.txt, source code contains<script>window.__xss=1</script>.txt
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48381.
I have tested this item ✅ successfully on 360d644
Tested with JBT and ZIP-archive created as test instruction given.
- Before PR seen file is shown as
.txtin File Content Preview and HTML source code contains<script>window.__xss=1</script> - Applied PR with Patch Tester and file name is shown as
<script>window.__xss=1</script>.txt, source code contains<script>window.__xss=1</script>.txt
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48381.
I have tested this item ✅ successfully on 360d644
Tested with JBT and ZIP-archive created as test instruction given.
- Before PR seen file is shown as
.txtin File Content Preview and HTML source code contains<script>window.__xss=1</script> - Applied PR with Patch Tester and file name is shown as
<script>window.__xss=1</script>.txt, source code contains<script>window.__xss=1</script>.txt, see screenshot
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48381.
I have tested this item ✅ successfully on 360d644
I've successfully verified the issue and tested the fix.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48381.
I have tested this item ✅ successfully on 360d644
I've successfully verified the issue and tested the fix.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48381.
| Status | Pending | ⇒ | Ready to Commit |
| Labels |
Added:
PR-5.4-dev
|
||
RTC as it has 2 successful human tests by the 5.4 release managers.
5.4 is now in security only support mode since October 13.
We consider this PR to be a security hardening which can be applied with the next 5.4.11 security release.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48381.
RTC as it has 2 successful human tests by the 5.4 release managers.
5.4 is now in security only support mode since October 13.
We consider this PR to be a security hardening which can be applied with the next 5.4.11 security release.
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48381.
| Labels |
Added:
RTC
|
||
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-10-21 04:09:47 |
| Closed_By | ⇒ | muhme |
Thank you very much @XananasX7 for your first time contribution. Thank you @exlemor and @richard67 for testing.
Hi @XananasX7, thank you very much for your PR!
Trying to test it during Happy Friday PR Testing session right now (https://joomlacommunity.cloud.mattermost.com/main/channels/pr-testing-group for more information)
Sadly, I admit having read it twice and not 100% sure what to do. Could you provide the ZIP file that you speak of in the testing instructions so that we are testing with the correct such zip file?
Thank you so much.