Concurrent media uploads overwrite one another and share one path

Summary

Concurrent uploads can select the same available filename before either request commits its file, causing two uploads to share or overwrite one path.

Affected Products

WordPress core 7.0.4; media upload filename allocation.

Affected Scope

Product

WordPress

Component

Media upload and unique filename allocation

Affected function

wp_unique_filename(); wp_handle_upload(); filename/path allocation

Affected versions

WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.

Safe version

No fixed version confirmed in the supplied material.

CWE

CWE-367; CWE-662

Technical Summary

Filename uniqueness is checked separately from file creation, leaving a race window in which concurrent uploads can select one path.

Prerequisites and Permissions

Authenticated users permitted to upload media; concurrency against the same directory is required.

Affected Locations

wp-includes/functions.php: wp_unique_filename(); wp-admin/includes/file.php upload handling; filename and destination path.

Reproducible Proof

Two controlled parallel uploads with the same basename were observed to receive the same path/content race outcome. Test files only; no executable content.

Vulnerable Code

$filename = wp_unique_filename( $uploads[&class="tok-comment">#39;pathclass="tok-string">'], $file['name'] );
move_uploaded_file( $file[&class="tok-comment">#39;tmp_nameclass="tok-string">'], $uploads['pathclass="tok-string">'] . '/' . $filename );

Severity

medium

Technical Analysis

The wp_unique_filename()/upload path checks filesystem availability and then writes later. Concurrent requests can observe the same free name between check and commit, creating a TOCTOU collision.

Impact

Integrity/availability impact is limited to media replacement or cross-request file confusion under concurrent uploads. No arbitrary file write or code execution is claimed.

Remediation

Use an atomic exclusive create/rename strategy or a collision-resistant server-side identifier, and test parallel uploads to the same basename.

Timeline

• 2026-09-15Published
• 2026-09-15Advisory published

Credits

Reported by Aria Akhavan. Submission: 2026-08-12; follow-up: 2026-09-07; no response documented by 2026-09-14.