In ./simple-image-manipulator/controller/download.php no checks are made to authenticate user or sanitize input when determining file location: 14 /* Figure out the MIME type | Check in array */ 15 $known_mime_types=array( 16 "pdf" => "application/pdf", 17 "txt" => "text/plain", 18 "html" => "text/html", 19 "htm" => "text/html", 20 "exe" => "application/octet-stream", 21 "zip" => "application/zip", 22 "doc" => "application/msword", 23 "xls" => "application/vnd.ms-excel", 24 "ppt" => "application/vnd.ms-powerpoint", 25 "gif" => "image/gif", 26 "png" => "image/png", 27 "jpeg"=> "image/jpg", 28 "jpg" => "image/jpg", 29 "php" => "text/plain" 30 ); 31 32 if($mime_type==''){ 33 $file_extension = strtolower(substr(strrchr($file,"."),1)); 34 if(array_key_exists($file_extension, $known_mime_types)){ 35 $mime_type=$known_mime_types[$file_extension]; 36 } else { 37 $mime_type="application/force-download"; 38 }; 39 };