GitHub Advisoryadvisory · Packagist
GHSA-hq76-662x-7mw4 Pimcore includes vulnerable PHPOffice/PhpSpreadsheet
HIGH
Official page ↗
- Ecosystem
- Packagist
- Packages
- pimcore/data-importer, pimcore/admin-ui-classic-bundle, pimcore/pimcore
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Reviewed
- 2024-09-03
Affected packages
• Packagist pimcore/data-importer: < 1.8.9 → fixed in 1.8.9
• Packagist pimcore/data-importer: >= 1.9.0, < 1.9.3 → fixed in 1.9.3
• Packagist pimcore/admin-ui-classic-bundle: < 1.3.11 → fixed in 1.3.11
• Packagist pimcore/admin-ui-classic-bundle: >= 1.4.0, < 1.4.7 → fixed in 1.4.7
• Packagist pimcore/admin-ui-classic-bundle: >= 1.5.0, < 1.5.4 → fixed in 1.5.4
• Packagist pimcore/pimcore: >= 10.6.9.0, < 10.6.9.12 → fixed in 10.6.9.12
• Packagist pimcore/pimcore: >= 11.1.0.0, < 11.1.6.11 → fixed in 11.1.6.11
Description
Summary
Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: GHSA-ghg6-32f9-2jp7.