New security patches introduced to the Wordpress core on October, 14th break media upload on my Wordpress installations.

That's due to my uncommon directory structure:

  • wp-config.php (custom)
  • index.php (custom)
  • wp (vanilla Wordpress Core)
    • wp-content (unused)
    • wp-cron.php
    • wp-blog-header.php
    • wp-includes
    • wp-admin
    • ...more...
  • wp-content (my custom, used wp-content directory)
    • plugins
    • themes
  • uploads (my custom, used uploads-directory)

So I set WP_SITEURL to my "wp"-directory, WP_CONTENT_DIR and WP_CONTENT_URL to my "wp-content"-directory and WP_PLUGIN_DIR and WP_PLUGIN_URL to my "wp-content/plugins"-directory.

Because Wordpress contructs the path of the uploads-Directory relative to the Wordpress core I needed to set UPLOADS to '../uploads'. So the resulting path of upload_dir() is "/wp/../uploads/" - that worked so far.

In October, 14th with 5.2.4 there was a change to how wp_mkdir_p() (in wp-includes/functions.php) sanitizes and checks the path of new directories it creates. Here's the SVN log:

r46274 | whyisjake | 2019-10-14 15:31:04 +0000 (Mo, 14. Okt 2019) | 8 Zeilen

Filesystem API: Prevent directory travelersals when creating new folders.

Reject file paths that contain sub-directory paths.

Props iandunn, xknown, sstoqnov, whyisjake.

Built from https://develop.svn.wordpress.org/trunk@46476

There's a newly added block of code that goes like this:

// Do not allow path traversals.
if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
    return false;

So all my Wordpress installations are unable to create a new directory "2019/11" in their uploads directory. However, if i manually create the folder, upload works, it's just the creation of new subfolders that stopped working.

My question: What's the best way to configure Wordpress in a way that allows me to keep my filesystem structure. One possibility is to modify the apply_filters( 'upload_dir', $uploads ) to remove the unnecessary "wp/../" from the path, but that requires a plugin and i'd like to get Wordpress working on my servers without having to install a plugin in each (because there are much of them).

  • Wordpress Bug: [core.trac.wordpress.org/ticket/48506] Other guys with the same problem: [foliovision.com/2019/11/wordpress-unable-to-create-directory] Nov 6, 2019 at 19:09
  • Hi @Matthias.... in your specific situation, is it necessary to keep your uploads sorted by year/month (as is default)? In mine, I don't particularly want all those additional folders created so I "uncheck" the box under Settings>Media that says "Organize my uploads into month- and year-based folders"...... if you don't need the extra folders, once you're setup then there is no need to continually be creating new folders within your structure....just a thought....
    – Trisha
    Nov 12, 2019 at 19:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.