From 11c8a16e328a9662b0eb023a44c68949c5d815e7 Mon Sep 17 00:00:00 2001
From: Bogdan <matolq@gmail.com>
Date: Mon, 14 Sep 2026 21:08:27 +0200
Subject: [PATCH] fix(cache): set secure directory (0755) and file (0644)
 permissions in FileVarExportHandler

---
 .../FactoriesCache/FileVarExportHandler.php   |  4 +-
 ...FactoriesCacheFileVarExportHandlerTest.php | 37 +++++++++++++++++++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/system/Cache/FactoriesCache/FileVarExportHandler.php b/system/Cache/FactoriesCache/FileVarExportHandler.php
index 023910c4b17d..241399a12035 100644
--- a/system/Cache/FactoriesCache/FileVarExportHandler.php
+++ b/system/Cache/FactoriesCache/FileVarExportHandler.php
@@ -23,7 +23,7 @@ public function save(string $key, mixed $val): void
 
         // Two processes may try to create the directory at the same time.
         // is_dir() confirms it exists, so suppressing the warning is safe.
-        if (! is_dir($this->path) && ! @mkdir($this->path, 0777, true) && ! is_dir($this->path)) {
+        if (! is_dir($this->path) && ! @mkdir($this->path, 0755, true) && ! is_dir($this->path)) {
             log_message('error', 'FactoriesCache: cannot create cache directory: ' . $this->path);
 
             return;
@@ -37,6 +37,8 @@ public function save(string $key, mixed $val): void
             return;
         }
 
+        @chmod($tmp, 0644);
+
         // Another process may have wiped the directory. Clean up on failure.
         if (! @rename($tmp, $this->path . "/{$key}")) {
             log_message('warning', 'FactoriesCache: failed to commit cache file for key: ' . $key);
diff --git a/tests/system/Cache/FactoriesCacheFileVarExportHandlerTest.php b/tests/system/Cache/FactoriesCacheFileVarExportHandlerTest.php
index c71c756f5cdd..e09816dba2fa 100644
--- a/tests/system/Cache/FactoriesCacheFileVarExportHandlerTest.php
+++ b/tests/system/Cache/FactoriesCacheFileVarExportHandlerTest.php
@@ -22,9 +22,46 @@
 #[Group('Others')]
 final class FactoriesCacheFileVarExportHandlerTest extends AbstractFactoriesCacheHandlerTestCase
 {
+    public static function setUpBeforeClass(): void
+    {
+        parent::setUpBeforeClass();
+
+        helper('filesystem');
+    }
+
     protected function createFactoriesCache(): void
     {
         $this->handler = new FileVarExportHandler();
         $this->cache   = new FactoriesCache($this->handler);
     }
+
+    public function testSaveCreatesDirectoryAndFileWithCorrectPermissions(): void
+    {
+        $dir      = WRITEPATH . 'cache_test_dir_' . uniqid('', true);
+        $oldUmask = umask(0000);
+
+        try {
+            $handler = new FileVarExportHandler();
+            $this->setPrivateProperty($handler, 'path', $dir);
+
+            $handler->save('test_key', ['data']);
+
+            $this->assertDirectoryExists($dir);
+
+            if (! is_windows()) {
+                $dirPerms = fileperms($dir) & 0777;
+                $this->assertSame(0755, $dirPerms);
+
+                $filePerms = fileperms($dir . '/test_key') & 0777;
+                $this->assertSame(0644, $filePerms);
+            }
+        } finally {
+            umask($oldUmask);
+
+            if (is_dir($dir)) {
+                delete_files($dir);
+                rmdir($dir);
+            }
+        }
+    }
 }