Sast

How Command Injection Happens in PHP Controllers and How to Fix It

A critical command injection vulnerability was discovered in LogsController.php where user-controlled file paths were passed directly to the `exec()` function. The fix replaces shell execution with safe PHP file iteration, eliminating the attack surface while preserving functionality and improving performance.