Commit 7ce0b653f1 for wordpress.org

commit 7ce0b653f1addec69df3147b793acce40de920ec
Author: adamsilverstein <adamsilverstein@git.wordpress.org>
Date:   Thu Sep 17 17:34:26 2026 +0000

    Editor: Constrain block template file resolution to the template directory.

    Props xknown, ramonopoly, jonsurrell.


    Built from https://develop.svn.wordpress.org/trunk@63663


    git-svn-id: http://core.svn.wordpress.org/trunk@62837 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/block-template-utils.php b/wp-includes/block-template-utils.php
index fa7a30edae..96d2372694 100644
--- a/wp-includes/block-template-utils.php
+++ b/wp-includes/block-template-utils.php
@@ -342,11 +342,22 @@ function _get_block_template_file( $template_type, $slug ) {
 	);
 	foreach ( $themes as $theme_slug => $theme_dir ) {
 		$template_base_paths = get_block_theme_folders( $theme_slug );
-		$file_path           = $theme_dir . '/' . $template_base_paths[ $template_type ] . '/' . $slug . '.html';
-		if ( file_exists( $file_path ) ) {
+		$template_dir        = $theme_dir . '/' . $template_base_paths[ $template_type ];
+		$file_path           = $template_dir . '/' . $slug . '.html';
+		$template_file       = realpath( $file_path );
+		$template_root       = realpath( $template_dir );
+
+		if (
+			false !== $template_file &&
+			false !== $template_root &&
+			str_starts_with(
+				wp_normalize_path( $template_file ),
+				trailingslashit( wp_normalize_path( $template_root ) )
+			)
+		) {
 			$new_template_item = array(
 				'slug'  => $slug,
-				'path'  => $file_path,
+				'path'  => $template_file,
 				'theme' => $theme_slug,
 				'type'  => $template_type,
 			);
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 2e9783e246..c7d6a7e452 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63660';
+$wp_version = '7.2-alpha-63663';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.