From ba27e660aef643ca784622c6d1fe94ad2c5165ed Mon Sep 17 00:00:00 2001
From: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:46:27 -0300
Subject: [PATCH] fix: prevent run PHP code at upload folder

Signed-off-by: Vitor Mattos <1079143+vitormattos@users.noreply.github.com>
---
 .docker/nginx/conf.d/default.conf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.docker/nginx/conf.d/default.conf b/.docker/nginx/conf.d/default.conf
index e75d1e6..dcc3b80 100644
--- a/.docker/nginx/conf.d/default.conf
+++ b/.docker/nginx/conf.d/default.conf
@@ -21,6 +21,9 @@ server {
     location / {
         try_files $uri $uri/ /index.php$is_args$args;
     }
+    location ~* ^/wp-content/uploads/.*\.php$ {
+        deny all;
+    }
     location ~ \.php$ {
         try_files $uri =404;
         fastcgi_split_path_info ^(.+\.php)(/.+)$;