Commit e5f67fb2da1 for php

commit e5f67fb2da17d481e4a3fdbf8b4d5b86685ef7df
Author: Daniel Scherzer <daniel.e.scherzer+phpf@gmail.com>
Date:   Mon Oct 26 14:33:39 2026 -0700

    LiteSpeed: document security considerations for executed paths (#24450)

    Make it clear that the `init_request_info()` function is indeed meant to be
    using `LSAPI_GetScriptFileName()` without any validation, and document in the
    README file that this lack of validation is another reason why only trusted
    sources should be granted direct access to the listener.

diff --git a/sapi/litespeed/README.md b/sapi/litespeed/README.md
index 3174bb55ad7..27f13ad2ba0 100644
--- a/sapi/litespeed/README.md
+++ b/sapi/litespeed/README.md
@@ -76,13 +76,20 @@ have lsphp bind to address 192.168.0.2:3000,

 have lsphp accept request on Unix domain socket `/tmp/lsphp_manual.sock`.

-### INI Security
+### Listener Security

 The lsphp listener must only be reachable by trusted sources, generally just
-the LiteSpeed web front end. Any source that can set its own environment variables
-can configure arbitrary PHP INI directives at the `ZEND_INI_SYSTEM` level for
-that request. This is the equivalent level of access as the Apache
-`php_admin_value` directive or the FPM's `PHP_ADMIN_VALUE` parameter.
+the LiteSpeed web front end. Allowing access from other sources may cause
+security issues:
+
+* Any source that can set its own environment variables can configure arbitrary
+PHP INI directives at the `ZEND_INI_SYSTEM` level for that request. This is the
+equivalent level of access as the Apache `php_admin_value` directive or the
+FPM `PHP_ADMIN_VALUE` parameter.
+* Any source that can invoke the lsphp listener can choose what file to execute
+based on the request contents. The file to execute is the file name reported by
+`LSAPI_GetScriptFileName()`, without additional validation.  Specifically, there
+is no enforcement of a docroot or `open_basedir` restriction.

 ## Using LiteSpeed PHP with LiteSpeed Web Server

diff --git a/sapi/litespeed/lsapi_main.c b/sapi/litespeed/lsapi_main.c
index 5b7fc3b6c84..d618cd220ca 100644
--- a/sapi/litespeed/lsapi_main.c
+++ b/sapi/litespeed/lsapi_main.c
@@ -621,6 +621,11 @@ static sapi_module_struct lsapi_sapi_module =
 };
 /* }}} */

+/* SG(request_info).path_translated comes from LSAPI_GetScriptFileName() without
+ * any additional validation; this is intentional, and is the mechanism by which
+ * LiteSpeed communicates the file to execute. The LiteSpeed listener should
+ * only be reachable from trusted callers. See README.md in this directory for
+ * more details. */
 static void init_request_info( void )
 {
     char * pContentType = LSAPI_GetHeader( H_CONTENT_TYPE );