Fix possible crash when installing plugin
What the developer wrote
Authored by Nicolas Dorier
Fix possible crash when installing plugin
What changed, and why it matters
This is a one-line bug fix that prevents a file-move operation from failing when a destination file already exists during plugin installation. The change makes the system overwrite the existing manifest file instead of throwing an error. It appears to be a stability fix for a rare edge case rather than a security vulnerability.
No immediate security action required. Treat as a routine stability patch. Review plugin installation flow separately if concerned about plugin manifest integrity.
Security signals we found
File system operation change (File.Move with overwrite)
Crash/stability fix during plugin installation
Evidence from the diff
The commit modifies PluginManager.cs to pass overwrite: true to File.Move() when relocating a plugin manifest file. Previously, if a manifest file already existed at the destination, the move would throw an IOException, potentially causing the plugin installation process to crash. The fix ensures the destination file is overwritten. There is no evidence in the commit of path traversal, arbitrary file overwrite, or attacker-controlled paths being introduced by this change.
Changed components
BTCPayServer/Plugins/PluginManager.csInspect captured patch +1 / −1
diff --git a/BTCPayServer/Plugins/PluginManager.cs b/BTCPayServer/Plugins/PluginManager.cs
index 310d000..cc67828 100644
--- a/BTCPayServer/Plugins/PluginManager.cs
+++ b/BTCPayServer/Plugins/PluginManager.cs
@@ -447,7 +447,7 @@ namespace BTCPayServer.Plugins
File.Delete(fileName);
if (File.Exists(manifestFileName))
{
- File.Move(manifestFileName, Path.Combine(dirName, Path.GetFileName(manifestFileName)));
+ File.Move(manifestFileName, Path.Combine(dirName, Path.GetFileName(manifestFileName)), true);
}
}
break;
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.