I'm working on a php application that is handling file upload.
I'm trying to inject a path transversal payload in the filename such as
The thing is that the vulnerable line of code is using the filename through the
$_FILES["name"] array. This built-in php array is doing an automatic sanitization on all the vulnerable special characters.
I was wondering if that is a sufficient protection or if we need to add some other sanitizations? Is there a way to bypass php sanitization?