@@ -16,7 +16,9 @@
 use CodeIgniter\Cache\Exceptions\CacheException;
 use CodeIgniter\I18n\Time;
 use Config\Cache;
+use FilesystemIterator;
 use Throwable;
+use UnexpectedValueException;
 
 /**
  * File system cache handler
@@ -117,10 +119,25 @@ public function delete(string $key): bool
 
     public function deleteMatching(string $pattern): int
     {
+        // The pattern is matched against file names only and never becomes part
+        // of a path, so it cannot reach files outside the cache directory.
+        // Passing the cache path to glob() would also interpret special
+        // characters in the path (e.g. "[") as part of the pattern.
+        try {
+            $iterator = new FilesystemIterator($this->path, FilesystemIterator::SKIP_DOTS);
+        } catch (UnexpectedValueException) {
+            return 0;
+        }
+
         $deleted = 0;
 
-        foreach (glob($this->path . $pattern, GLOB_NOSORT) as $filename) {
-            if (is_file($filename) && @unlink($filename)) {
+        foreach ($iterator as $file) {
+            // FNM_PERIOD keeps glob() semantics: wildcards don't match a leading dot.
+            if (! fnmatch($pattern, $file->getFilename(), FNM_PERIOD)) {
+                continue;
+            }
+
+            if ($file->isFile() && @unlink($file->getPathname())) {
                 $deleted++;
             }
         }
 
@@ -210,6 +210,132 @@ public function testDeleteMatchingSuffix(): void
         $this->handler->clean();
     }
 
+    /**
+     * @param string $pattern "{victim}" is replaced with the name of a file in the parent of the cache directory
+     */
+    #[DataProvider('provideDeleteMatchingDoesNotDeleteFilesOutsideCacheDirectory')]
+    public function testDeleteMatchingDoesNotDeleteFilesOutsideCacheDirectory(string $pattern): void
+    {
+        $parent = realpath(dirname($this->config->file['storePath']));
+        $this->assertNotFalse($parent);
+
+        $victim = tempnam($parent, 'deleteMatchingVictim');
+        $this->assertNotFalse($victim);
+
+        try {
+            // tempnam() falls back to the system temp directory on failure.
+            $this->assertSame($parent, realpath(dirname($victim)));
+
+            $this->assertTrue($this->handler->save(self::$key1, 'value'));
+
+            $pattern = str_replace('{victim}', basename($victim), $pattern);
+
+            $this->assertSame(0, $this->handler->deleteMatching($pattern));
+            $this->assertFileExists($victim);
+            $this->assertSame('value', $this->handler->get(self::$key1));
+        } finally {
+            if (is_file($victim)) {
+                unlink($victim);
+            }
+        }
+    }
+
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function provideDeleteMatchingDoesNotDeleteFilesOutsideCacheDirectory(): iterable
+    {
+        yield 'parent directory' => ['../{victim}'];
+
+        yield 'parent directory with wildcard' => ['../{victim}*'];
+
+        yield 'parent directory with backslash' => ['..\\{victim}'];
+
+        yield 'parent directory only' => ['..'];
+    }
+
+    public function testDeleteMatchingDoesNotDeleteFilesInSubdirectories(): void
+    {
+        $directoryName = 'dir_' . bin2hex(random_bytes(8));
+        $subdirectory  = $this->config->file['storePath'] . '/' . $directoryName . '/';
+
+        $this->assertTrue(mkdir($subdirectory));
+
+        try {
+            $this->assertNotFalse(file_put_contents($subdirectory . 'key_1', 'data'));
+
+            $this->assertSame(0, $this->handler->deleteMatching($directoryName . '/key_*'));
+            $this->assertFileExists($subdirectory . 'key_1');
+        } finally {
+            if (is_file($subdirectory . 'key_1')) {
+                unlink($subdirectory . 'key_1');
+            }
+
+            rmdir($subdirectory);
+        }
+    }
+
+    #[RequiresOperatingSystem('Linux|Darwin')]
+    public function testDeleteMatchingSupportsEscapedWildcards(): void
+    {
+        $this->assertTrue($this->handler->save('key*1', 'value'));
+        $this->assertTrue($this->handler->save('key_1', 'value'));
+
+        $this->assertSame(1, $this->handler->deleteMatching('key\*1'));
+        $this->assertNull($this->handler->get('key*1'));
+        $this->assertSame('value', $this->handler->get('key_1'));
+    }
+
+    public function testDeleteMatchingTreatsCachePathLiterally(): void
+    {
+        // As a glob pattern, "cache[1]" would match the sibling "cache1" instead of itself.
+        $cachePath   = $this->config->file['storePath'] . '/cache[1]/';
+        $siblingPath = $this->config->file['storePath'] . '/cache1/';
+
+        $this->assertTrue(mkdir($cachePath));
+        $this->assertTrue(mkdir($siblingPath));
+
+        try {
+            $this->assertNotFalse(file_put_contents($siblingPath . 'key_1', 'data'));
+
+            $config                    = new Cache();
+            $config->file['storePath'] = $cachePath;
+            $handler                   = CacheFactory::getHandler($config, 'file');
+
+            $this->assertTrue($handler->save('key_1', 'value'));
+
+            $this->assertSame(1, $handler->deleteMatching('*'));
+            $this->assertNull($handler->get('key_1'));
+            $this->assertFileExists($siblingPath . 'key_1');
+        } finally {
+            foreach ([$cachePath, $siblingPath] as $path) {
+                if (is_file($path . 'key_1')) {
+                    unlink($path . 'key_1');
+                }
+
+                rmdir($path);
+            }
+        }
+    }
+
+    public function testDeleteMatchingWildcardDoesNotMatchHiddenFiles(): void
+    {
+        $hidden = $this->config->file['storePath'] . '/.hidden';
+
+        $this->assertNotFalse(file_put_contents($hidden, 'data'));
+
+        try {
+            $this->assertTrue($this->handler->save(self::$key1, 'value'));
+
+            $this->assertSame(1, $this->handler->deleteMatching('*'));
+            $this->assertFileExists($hidden);
+        } finally {
+            if (is_file($hidden)) {
+                unlink($hidden);
+            }
+        }
+    }
+
     public function testIncrement(): void
     {
         $this->handler->save(self::$key1, 1);
 
@@ -10,6 +10,19 @@ Release Date: Unreleased
     :local:
     :depth: 3
 
+********
+SECURITY
+********
+
+- **Cache:** ``FileHandler::deleteMatching()`` now matches the pattern against cache
+  file names only. Previously, a pattern such as ``../*`` could delete files outside
+  the cache directory. Patterns can no longer match files in subdirectories of the
+  cache directory, so those files are no longer deleted. Special characters in the 
+  cache path, such as ``[``, are no longer interpreted as part of the pattern.
+  See the `Security advisory GHSA-9hf2-g3w9-pfmp <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9hf2-g3w9-pfmp>`_
+  for more information. See :ref:`upgrade-476-cache-delete-matching` for migration
+  instructions.
+
 ********
 BREAKING
 ********
 
@@ -20,6 +20,28 @@ Mandatory File Changes
 Breaking Changes
 ****************
 
+.. _upgrade-476-cache-delete-matching:
+
+File Cache deleteMatching() No Longer Matches Subdirectories
+============================================================
+
+For security reasons, ``FileHandler::deleteMatching()`` now matches the pattern against
+the names of files in the cache directory only. See the
+`Security advisory GHSA-9hf2-g3w9-pfmp <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9hf2-g3w9-pfmp>`_
+for more information.
+
+Previously, the pattern was appended to the cache path and passed to ``glob()``, so a
+pattern containing a directory separator, such as ``dir/key_*``, also deleted matching
+files in a subdirectory of the cache directory. Such a pattern now never matches
+anything and the method returns ``0``.
+
+Most applications are not affected. The File handler stores every cache item directly
+in the cache directory, and the default ``Config\Cache::$reservedCharacters`` forbid
+``/`` and ``\`` in cache keys, so cache items could not be stored in subdirectories.
+If your application places its own files in subdirectories of the cache directory and
+removed them with ``deleteMatching()``, delete them directly instead, for example with
+the :php:func:`delete_files()` helper function.
+
 *********************
 Breaking Enhancements
 *********************
 
@@ -179,6 +179,10 @@ Class Reference
         .. important:: This method is only implemented for File, Redis and Predis handlers.
             Due to limitations, it couldn't be implemented for Memcached and Wincache handlers.
 
+        .. note:: With the File handler, the pattern is matched against cache
+            file names only and cannot match files in subdirectories. A pattern
+            containing a forward slash (``/``) therefore never matches.
+
         Example:
 
         .. literalinclude:: caching/006.php