diff --git a/src/Game/Service/GameResponseService.php b/src/Game/Service/GameResponseService.php index 04b789d..9917811 100644 --- a/src/Game/Service/GameResponseService.php +++ b/src/Game/Service/GameResponseService.php @@ -240,7 +240,9 @@ class GameResponseService } $filename = $messagePart[1]; - $fullPath = ($pwd === '/' ? '' : $pwd) . '/' . $filename; + $fullPath = str_starts_with($filename, '/') + ? $filename + : ($pwd === '/' ? '' : $pwd) . '/' . $filename; if(!$this->isAllowedToRemove($fullPath, $player, $sudo)) return ['result' => ['You are not allowed to remove this file.']];