Comment by tyingq

There's a bit of code to try and stop path traversal, but it doesn't account for passing d=.. as a url param.

A shortened test case using the same code as the app to try and thwart traversal:

  <?php
    $_GET['d']='..';
    $photo_dir='photos/';
    $sub_photo_dir = basename($_GET['d']).'/';
    $photo_dir = str_replace("//",
      "/",$photo_dir.$sub_photo_dir);
    print "photo_dir: [$photo_dir]";
  ?>

That would allow you to upload a file one directory above the intended $photo_dir.