GitHub Advisoryadvisory · Packagist

GHSA-6rgh-r6j3-3223 czim/file-handling vulnerable to SSRF and directory traversal

MEDIUM Published 2024-09-17 Modified 2025-03-19 Official page ↗
Aliases
CVE-2024-47049
Ecosystem
Packagist
Packages
czim/file-handling
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-22, CWE-918
Reviewed
2024-09-17

Affected packages

• Packagist czim/file-handling: < 1.5.0 → fixed in 1.5.0 • Packagist czim/file-handling: >= 2.0.0, < 2.3.0 → fixed in 2.3.0

Description

The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

Related

Alias · CVE (1)

  • CVE-2024-47049 The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-918 Server-Side Request Forgery weakness

References