{
    "archive_path": "archive/1790291459.346186",
    "base_url": "github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
    "basename": "GHSA-7hp8-65ch-5whp",
    "bookmarked_date": "2026-09-24 23:10",
    "canonical": {
        "archive_org_path": "https://web.archive.org/web/github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
        "dom_path": "output.html",
        "favicon_path": "favicon.ico",
        "git_path": "git/",
        "google_favicon_path": "https://www.google.com/s2/favicons?domain=github.com",
        "headers_path": "headers.json",
        "htmltotext_path": "htmltotext.txt",
        "index_path": "index.html",
        "media_path": "media/",
        "mercury_path": "mercury/content.html",
        "pdf_path": "output.pdf",
        "readability_path": "readability/content.html",
        "screenshot_path": "screenshot.png",
        "singlefile_path": "singlefile.html",
        "warc_path": "warc/",
        "wget_path": "github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp.html"
    },
    "domain": "github.com",
    "extension": "",
    "hash": "1REA9Y6AP5MEPMRFT746",
    "history": {
        "archive_org": [],
        "dom": [],
        "favicon": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--output",
                    "favicon.ico",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://www.google.com/s2/favicons?domain=github.com"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-09-24T23:11:00.539085+00:00",
                "index_texts": null,
                "output": "favicon.ico",
                "pwd": "/data/archive/1790291459.346186",
                "schema": "ArchiveResult",
                "start_ts": "2026-09-24T23:10:59.831822+00:00",
                "status": "succeeded"
            }
        ],
        "git": [],
        "headers": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--head",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-09-24T23:11:01.229508+00:00",
                "index_texts": null,
                "output": "headers.json",
                "pwd": "/data/archive/1790291459.346186",
                "schema": "ArchiveResult",
                "start_ts": "2026-09-24T23:11:00.550151+00:00",
                "status": "succeeded"
            }
        ],
        "htmltotext": [],
        "media": [],
        "mercury": [
            {
                "cmd": [
                    "/app/node_modules/@postlight/parser/cli.js",
                    "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"
                ],
                "cmd_version": "1.0.0",
                "end_ts": "2026-09-24T23:11:15.614418+00:00",
                "index_texts": null,
                "output": "mercury",
                "pwd": "/data/archive/1790291459.346186",
                "schema": "ArchiveResult",
                "start_ts": "2026-09-24T23:11:08.956394+00:00",
                "status": "succeeded"
            }
        ],
        "pdf": [],
        "readability": [
            {
                "cmd": [
                    "/app/node_modules/readability-extractor/readability-extractor",
                    "/tmp/tmpm6yxsrz1",
                    "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"
                ],
                "cmd_version": "0.0.11",
                "end_ts": "2026-09-24T23:11:08.940763+00:00",
                "index_texts": [
                    "An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE.\nThe pre-conditions are:\n\nThe active child or parent theme contains a top-level directory whose name starts with page- (e.g. page-templates). This affects the legacy Twenty Twelve and Twenty Fourteen themes, as well as some popular third party themes such as Neve, Hestia, and Sydney.\nA chosen local .php target file exists on the server and is readable by the web server account. The well known pearcmd.php PEAR\u2192RCE transition can be used for this when register_argc_argv is set to On. The official php image for Docker is affected, and the default cPanel configuration is affected when PHP prior to 8.5 is in use.\n\nWordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.\nDiscovered and responsibly disclosed by Robert Ressl."
                ],
                "output": "readability",
                "pwd": "/data/archive/1790291459.346186",
                "schema": "ArchiveResult",
                "start_ts": "2026-09-24T23:11:06.485311+00:00",
                "status": "succeeded"
            }
        ],
        "screenshot": [],
        "singlefile": [],
        "title": [
            {
                "cmd": [
                    "curl",
                    "--silent",
                    "--location",
                    "--compressed",
                    "--max-time",
                    "120",
                    "--user-agent",
                    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) curl/curl 8.14.1 (x86_64-pc-linux-gnu)",
                    "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"
                ],
                "cmd_version": "curl 8.14.1 (x86_64-pc-linux-gnu)",
                "end_ts": "2026-09-24T23:11:06.477363+00:00",
                "index_texts": null,
                "output": "Unauthenticated path traversal in page-template resolution leading to conditional RCE \u00b7 Advisory \u00b7 WordPress/wordpress-develop \u00b7 GitHub",
                "pwd": "/data/archive/1790291459.346186",
                "schema": "ArchiveResult",
                "start_ts": "2026-09-24T23:11:06.425733+00:00",
                "status": "succeeded"
            }
        ],
        "wget": [
            {
                "cmd": [
                    "wget",
                    "--no-verbose",
                    "--adjust-extension",
                    "--convert-links",
                    "--force-directories",
                    "--span-hosts",
                    "--no-parent",
                    "-e",
                    "robots=off",
                    "--reject=js,mjs,woff,woff2,ttf,otf,eot,mp4,m4v,mov,webm,ogv,mkv,avi,flv",
                    "--timeout=120",
                    "--restrict-file-names=windows",
                    "--page-requisites",
                    "--user-agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 ArchiveBox/0.7.4 (+https://github.com/ArchiveBox/ArchiveBox/) wget/GNU Wget 1.21.3",
                    "--compression=auto",
                    "--timestamping",
                    "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"
                ],
                "cmd_version": "GNU Wget 1.21.3",
                "end_ts": "2026-09-24T23:11:06.415814+00:00",
                "index_texts": null,
                "output": "github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp.html",
                "pwd": "/data/archive/1790291459.346186",
                "schema": "ArchiveResult",
                "start_ts": "2026-09-24T23:11:01.239387+00:00",
                "status": "succeeded"
            }
        ]
    },
    "icons": null,
    "is_archived": true,
    "is_static": false,
    "latest": {
        "archive_org": null,
        "dom": null,
        "favicon": "favicon.ico",
        "git": null,
        "media": null,
        "pdf": null,
        "screenshot": null,
        "singlefile": null,
        "title": "Unauthenticated path traversal in page-template resolution leading to conditional RCE \u00b7 Advisory \u00b7 WordPress/wordpress-develop \u00b7 GitHub",
        "warc": null,
        "wget": "github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp.html"
    },
    "link_dir": "/data/archive/1790291459.346186",
    "newest_archive_date": "2026-09-24T23:11:08.956394+00:00",
    "num_failures": 0,
    "num_outputs": 6,
    "oldest_archive_date": "2026-09-24T23:10:59.831822+00:00",
    "path": "/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp",
    "schema": "Link",
    "scheme": "https",
    "snapshot_id": "6d64e6d1-2778-463b-8891-370f9caadb0d",
    "sources": [
        "/data/sources/1790291459-import.txt"
    ],
    "tags": null,
    "tags_str": "",
    "timestamp": "1790291459.346186",
    "title": "Unauthenticated path traversal in page-template resolution leading to conditional RCE \u00b7 Advisory \u00b7 WordPress/wordpress-develop \u00b7 GitHub",
    "updated": "2026-09-24T23:10:59.831559+00:00",
    "updated_date": "2026-09-24 23:10",
    "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp"
}