GHSA-6rgh-r6j3-3223
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6rgh-r6j3-3223
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-6rgh-r6j3-3223/GHSA-6rgh-r6j3-3223.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-6rgh-r6j3-3223
- Aliases
- Published
- 2024-09-17T15:31:23Z
- Modified
- 2024-09-17T21:42:27.121318Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- czim/file-handling vulnerable to SSRF and directory traversal
- Details
-
The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2024-47049
- https://github.com/czim/file-handling/commit/95dfda850536bf35e684619598b9d02f4c97680d
- https://github.com/czim/file-handling/commit/dcf879896efe3457f51af9c8eab9f70dfc709a99
- https://github.com/czim/file-handling
- https://github.com/czim/file-handling/blob/2.3.0/SECURITY.md
Affected packages
Packagist / czim/file-handling
Package
- Name
- czim/file-handling
- Purl
- pkg:composer/czim/file-handling
Packagist / czim/file-handling
Package
- Name
- czim/file-handling
- Purl
- pkg:composer/czim/file-handling