GitHub Advisoryadvisory · Packagist

GHSA-26hp-cgjj-m2j3 fuel/core ImageMagick driver does not escape all shell arguments.

HIGH Published 2024-05-15 Modified 2024-05-15 Official page ↗
Ecosystem
Packagist
Packages
fuel/core
Severity
High
Weaknesses
CWE-78
Reviewed
2024-05-15

Affected packages

• Packagist fuel/core: < 1.8.0.4 → fixed in 1.8.0.4

Description

This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver.

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References