path_prescan report — 5 file(s), 24 finding(s)

HIGH   PT-REQ-FILE-SINK    app.py:10  request-controlled value reaches a filesystem sink
       | return open(request.args['f']).read()
HIGH   PT-ARCHIVE-EXTRACT  app.py:16  archive extract without traversal filter/guard
       | tf.extractall(out)
HIGH   PT-ARCHIVE-EXTRACT  app.py:18  archive extract without traversal filter/guard
       | zf.extractall(out)
HIGH   PT-REQ-FILE-SINK    app.py:24  request-controlled value reaches a filesystem sink
       | p = os.path.join('/srv/files', request.args.get('name'))
HIGH   PT-PHP-INCLUDE      up.php:3  include/require with superglobal input
       | include $_GET['p'];
HIGH   PT-REQ-FILE-SINK    up.php:6  request-controlled value reaches a filesystem sink
       | $body = file_get_contents($_POST['src']);
HIGH   PT-REQ-FILE-SINK    util.js:6  request-controlled value reaches a filesystem sink
       | const p = path.join(__dirname, 'files', req.params.name);
HIGH   PT-REQ-FILE-SINK    util.js:11  request-controlled value reaches a filesystem sink
       | res.download(req.query.f);
MEDIUM PT-DYNAMIC-SERVE    app.py:25  file serve/download path is non-literal
       | return send_file(p)
MEDIUM PT-DYNAMIC-SERVE    app.py:30  file serve/download path is non-literal
       | return send_file(fname)
MEDIUM PT-DYNAMIC-SERVE    app.py:48  file serve/download path is non-literal
       | return send_file(p)
MEDIUM PT-ENTRY-NAME       extract.go:14  archive-entry name used to build output path
       | out := filepath.Join(dest, f.Name())
MEDIUM PT-UPLOAD-NAME      up.php:9  upload-supplied filename reaches a destination path
       | $dest = '/var/www/uploads/' . $_FILES['f']['name'];
MEDIUM PT-UPLOAD-NAME      up.php:10  upload-supplied filename reaches a destination path
       | move_uploaded_file($_FILES['f']['tmp_name'], $dest);
MEDIUM PT-PHP-INCLUDE      up.php:13  include/require with a variable path
       | include_once($tpl);
MEDIUM PT-DYNAMIC-SERVE    util.js:7  file serve/download path is non-literal
       | res.sendFile(p);
MEDIUM PT-UPLOAD-NAME      util.js:20  upload-supplied filename reaches a destination path
       | return path.join(UPLOAD_DIR, file.originalname);
LOW    PT-MKTEMP           app.py:34  predictable temp path — symlink-race prone
       | tmp = tempfile.mktemp()
LOW    PT-CHMOD-WIDE       app.py:35  world-writable permission bits in app code
       | os.chmod(tmp, 0o777)
LOW    PT-DYNAMIC-DELETE   app.py:41  delete/rmtree target is non-literal
       | shutil.rmtree(workdir)
LOW    PT-JOIN-VAR         app.py:47  join/resolve of user-data segment does not stop '..'
       | p = os.path.join('/srv/files', secure_filename(name))
LOW    PT-ARCHIVE-EXTRACT  clean.py:11  archive extract without traversal filter/guard
       | tf.extractall(out, filter='data')
LOW    PT-MKTEMP           up.php:16  predictable temp path — symlink-race prone
       | $tmp = tempnam('/tmp', 'x');
LOW    PT-DYNAMIC-DELETE   util.js:15  delete/rmtree target is non-literal
       | fs.unlink(target);

scope: deterministic pre-scan — flags patterns for review; not an audit, clean != path-safe