GitHub Advisoryadvisory · Packagist

GHSA-ph62-8768-r87v Arbitrary file delete in ectouch/ectouch

CRITICAL Published 2022-02-25 Modified 2022-03-03 Official page ↗

Aliases: CVE-2022-25098
Ecosystem: Packagist
Packages: ectouch/ectouch
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Reviewed: 2022-03-03

Affected packages

• Packagist ectouch/ectouch: <= 2.7.2 (no fix yet)

Description

ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.

Related

Alias · CVE (1)

CVE-2022-25098 ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter. vulnerability

References