From 14dc36b813b8e697c7f2d99f9e3bcd7b2202f05e Mon Sep 17 00:00:00 2001
From: Nikita Sinelnikov <nsinelnikov.work@gmail.com>
Date: Tue, 27 Sep 2022 13:58:01 +0300
Subject: [PATCH] - fixed directory traversal vulnerability;

---
 includes/core/class-shortcodes.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/includes/core/class-shortcodes.php b/includes/core/class-shortcodes.php
index 1f122743..461e06d2 100644
--- a/includes/core/class-shortcodes.php
+++ b/includes/core/class-shortcodes.php
@@ -276,6 +276,9 @@ if ( ! class_exists( 'um\core\Shortcodes' ) ) {
 				extract( $args );
 			}
 
+			// Avoid Directory Traversal vulnerability.
+			$tpl = trim( $tpl, "./\\" );
+
 			$file = um_path . "templates/{$tpl}.php";
 			$theme_file = get_stylesheet_directory() . "/ultimate-member/templates/{$tpl}.php";
 			if ( file_exists( $theme_file ) ) {