From 5875e8b86bea5cfb9d7562b3914e89642e4359f6 Mon Sep 17 00:00:00 2001
From: thisgun <thisgun@naver.com>
Date: Wed, 15 Apr 2026 07:50:38 +0000
Subject: [PATCH] =?UTF-8?q?[security]KVE-2026-0690=20=EC=84=A4=EB=AC=B8?=
 =?UTF-8?q?=EC=A1=B0=EC=82=AC=20=EA=B2=B0=EA=B3=BC=20=ED=8E=98=EC=9D=B4?=
 =?UTF-8?q?=EC=A7=80=20Local=20File=20Inclusion=20=EC=88=98=EC=A0=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

skin_dir 파라미터에 디렉토리 트래버설 검증이 없어
임의 경로의 PHP 파일을 include할 수 있는 취약점을
clean_relative_paths()로 경로 조작 문자열 제거하여 수정

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 bbs/poll_result.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/bbs/poll_result.php b/bbs/poll_result.php
index 01e43773f..7a6d3d192 100644
--- a/bbs/poll_result.php
+++ b/bbs/poll_result.php
@@ -3,6 +3,7 @@ include_once('./_common.php');
 include_once(G5_CAPTCHA_PATH.'/captcha.lib.php');
 
 $po_id   = isset($_REQUEST['po_id']) ? (int) $_REQUEST['po_id'] : '';
+$skin_dir = isset($skin_dir) ? clean_relative_paths(strip_tags($skin_dir)) : '';
 
 $po = sql_fetch(" select * from {$g5['poll_table']} where po_id = '{$po_id}' ");
 if (!$po['po_id'])