# linkinfo - openbasedir bypass on Windows PHP

PHP's linkinfo() on Windows skipped the open_basedir check, letting shared-hosting attackers probe for files outside allowed directories.

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2018-10-15
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/384719
- Library page: https://bugbountylibrary.com/r/h1%3A384719
- Tags: domain:oss impact:internal-access kind:bounty platform:hackerone sev:medium tech:php tech:windows technique:source-review vuln:access-control vuln:info-disclosure vuln:path-traversal

**Target:** PHP linkinfo() function on Windows
**Root cause:** The Windows implementation of linkinfo() in ext/standard/link_win32.c omitted the open_basedir restriction check that the Unix implementation (link.c) performs.
**Steps:**
1. Set open_basedir to a restricted directory on a Windows PHP host.
2. Call `linkinfo('c:\\jump')`, `linkinfo('c:\\jump\\folder\\file1.txt')`, `linkinfo('c:\\jump\\blabla')` on paths outside the allowed dir.
3. Observe no open_basedir warning is raised, unlike Unix; return values reveal existence of paths outside the restriction.
**How found:** Source-code review comparing the Windows link_win32.c implementation against the Unix link.c, noticing the missing open_basedir check in the Windows path.
**Exploitation:** Attacker on shared hosting uses linkinfo() return values to enumerate files/directories outside the open_basedir sandbox, bypassing the hosting provider's isolation.
**Insight:** When auditing PHP internals, diff platform-specific implementations (win32 vs unix) of the same function — security checks like open_basedir are often present in one and forgotten in the other.