GitHub Advisoryadvisory · Packagist

GHSA-2gq2-m628-33xp gregwar/rst Local File Inclusion Vulnerability

HIGH Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: gregwar/rst
Severity: High
Reviewed: 2024-05-15

Affected packages

• Packagist gregwar/rst: < 1.0.3 → fixed in 1.0.3

Description

A Local File Inclusion (LFI) vulnerability has been discovered in the gregwar/rst library, potentially exposing sensitive files on the server to unauthorized users. The issue arises from inadequate input validation, allowing an attacker to manipulate file paths and include arbitrary files.

References

https://github.com/Gregwar/RST/pull/34 web
https://github.com/Gregwar/RST/commit/e8d90ccbeddd91ba3abc506079661dce234f9870 web
https://hackerone.com/reports/179034 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/gregwar/rst/2016-10-31.yaml web
https://github.com/Gregwar/RST package