GitHub Advisoryadvisory · Packagist

GHSA-g857-47pm-3r32 laravel-admin has Arbitrary File Upload vulnerability

HIGH Published 2023-02-27 Modified 2023-03-08 Official page ↗

Aliases: CVE-2023-24249
Ecosystem: Packagist
Packages: encore/laravel-admin
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-434
Reviewed: 2023-03-08

Affected packages

• Packagist encore/laravel-admin: <= 1.8.19 (no fix yet)

Description

An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.

Related

Alias · CVE (1)

CVE-2023-24249 An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file. vulnerability

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References