# PHP builded for Windows with TS support does not resolve relalative paths with drive letter correctly

PHP TS builds on Windows resolve drive-relative paths like C:secret_data.txt to the drive root instead of the current directory, bypassing path validation middleware.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: vorismi3
- Disclosed: 2020-11-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/797159
- Library page: https://bugbountylibrary.com/r/h1%3A797159
- Tags: area:os domain:desktop impact:data-leak impact:integrity kind:bounty platform:hackerone sev:medium tech:php tech:windows technique:parser-differential vuln:path-traversal

**Target:** PHP runtime path resolution on Windows (thread-safe build)
**Root cause:** PHP with ZTS on Windows treats drive-relative paths such as `C:Users` as absolute, resolving them against the drive root rather than the current working directory, diverging from the app's own normalization.
**Steps:**
1. Set PHP cwd to `C:/Web/uploads`
2. App validates user path `C:secret_data.txt` as within cwd (resolves to `C:/Web/uploads/secret_data.txt`)
3. PHP instead opens `C:/secret_data.txt` at drive root
4. Craft path to `C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup` to write a startup file
**How found:** Observed that PHP TS builds on Windows resolve `C:Users` as absolute, contradicting the app-level normalization, and tested the mismatch between validated path and actual resolved path.
**Exploitation:** Attacker supplies a drive-relative path that passes the application's containment check but is resolved by PHP to the drive root, enabling read of arbitrary files on the drive or write into sensitive locations like the Startup folder for code execution on login.
**Escalation:** Write access to the Startup folder yields persistence/code execution at user login.
**Insight:** On Windows, drive-relative paths (`C:foo`) are neither absolute nor relative in the POSIX sense; any path-containment check must account for PHP's own resolution differing from the validator's, especially in ZTS builds.