Index: wp-includes/functions.php
===================================================================
--- wp-includes/functions.php	(révision 41663)
+++ wp-includes/functions.php	(copie de travail)
@@ -4252,19 +4252,27 @@
  * @return int 0 means nothing is wrong, greater than 0 means something was wrong.
  */
 function validate_file( $file, $allowed_files = '' ) {
-	if ( false !== strpos( $file, '..' ) )
-		return 1;
+	$result = 0;
 
-	if ( false !== strpos( $file, './' ) )
-		return 1;
+	if (':' == substr( $file, 1, 1 ) )
+		$result = 2;
 
 	if ( ! empty( $allowed_files ) && ! in_array( $file, $allowed_files ) )
-		return 3;
+		$result = 3;
 
-	if (':' == substr( $file, 1, 1 ) )
-		return 2;
-
-	return 0;
+	if ( preg_match( '#\.\./#', $file, $matches ) && ( count( $matches ) > 1 || '../' != substr( $file, -2, 2 ) ) )
+		$result = 1;
+		
+	/**
+	 * Filters the returned result.
+	 *
+	 * @since 4.8.3
+	 *
+	 * @param int As described for the return value of the function.
+	 * @param string $file As provided to the function (file path).
+	 * @param array  $allowed_files As provided to the function (list of allowed files).
+	 */
+	return apply_filters( 'validate_file', $result, $file, $allowed_files );
 }
 
 /**