New security patches introduced to the Wordpress core on October, 14th break media upload on my Wordpress installations.

That's due to my uncommon directory structure:

  • wp-config.php (custom)
  • index.php (custom)
  • wp (vanilla Wordpress Core)
    • wp-content (unused)
    • wp-cron.php
    • wp-blog-header.php
    • wp-includes
    • wp-admin
    • ...more...
  • wp-content (my custom, used wp-content directory)
    • plugins
    • themes
  • uploads (my custom, used uploads-directory)

So I set WP_SITEURL to my "wp"-directory, WP_CONTENT_DIR and WP_CONTENT_URL to my "wp-content"-directory and WP_PLUGIN_DIR and WP_PLUGIN_URL to my "wp-content/plugins"-directory.

Because Wordpress contructs the path of the uploads-Directory relative to the Wordpress core I needed to set UPLOADS to '../uploads'. So the resulting path of upload_dir() is "/wp/../uploads/" - that worked so far.

In October, 14th with 5.2.4 there was a change to how wp_mkdir_p() (in wp-includes/functions.php) sanitizes and checks the path of new directories it creates. Here's the SVN log:

r46274 | whyisjake | 2019-10-14 15:31:04 +0000 (Mo, 14. Okt 2019) | 8 Zeilen

Filesystem API: Prevent directory travelersals when creating new folders.

Reject file paths that contain sub-directory paths.

Props iandunn, xknown, sstoqnov, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46476

There's a newly added block of code that goes like this:

// Do not allow path traversals.
if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
    return false;

So all my Wordpress installations are unable to create a new directory "2019/11" in their uploads directory. However, if i manually create the folder, upload works, it's just the creation of new subfolders that stopped working.

My question: What's the best way to configure Wordpress in a way that allows me to keep my filesystem structure. One possibility is to modify the apply_filters( 'upload_dir', $uploads ) to remove the unnecessary "wp/../" from the path, but that requires a plugin and i'd like to get Wordpress working on my servers without having to install a plugin in each (because there are much of them).

  • Wordpress Bug: [core.trac.wordpress.org/ticket/48506] Other guys with the same problem: [foliovision.com/2019/11/wordpress-unable-to-create-directory] Nov 6, 2019 at 19:09
  • Hi @Matthias.... in your specific situation, is it necessary to keep your uploads sorted by year/month (as is default)? In mine, I don't particularly want all those additional folders created so I "uncheck" the box under Settings>Media that says "Organize my uploads into month- and year-based folders"...... if you don't need the extra folders, once you're setup then there is no need to continually be creating new folders within your structure....just a thought....
    – Trisha
    Nov 12, 2019 at 19:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.