GitHub Advisoryadvisory · Packagist
GHSA-mvf6-3f2g-xfxf endroid/qr-code-bundle File Disclosure via logo_path query parameter
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- endroid/qr-code-bundle
- Severity
- Moderate
- Weaknesses
- CWE-200
- Reviewed
- 2024-05-15
Affected packages
• Packagist endroid/qr-code-bundle: < 3.4.2 → fixed in 3.4.2
Description
Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/endroid/qr-code-bundle/2019-12-22.yaml web
- https://github.com/endroid/qr-code-bundle package
- https://github.com/endroid/qr-code-bundle/releases/tag/3.4.2 web