title: PHP: tcpdf security considerations of cache folder with write permission
body: <p>I have installed tcpdf on my web server and use it to generate pdf invoices. It has a cache folder and my web server user group www-data can create and delete files.</p>
  
  <p>Could a hacker</p>
  
  <p>a) create files in that folder and</p>
  
  <p>b) execute them as php?</p>
  
  <p>Should I move the cache folder outside of the www directory? I tried to cd into the folder but get a permission error with my own username, so I was wondering if that step is necessary.</p>