GHSA-vx6j-pjrh-vgjh PHP file inclusion in the Sulu admin panel

• Packagist sulu/sulu: < 1.6.44 → fixed in 1.6.44 • Packagist sulu/sulu: >= 2.0.0, < 2.2.18 → fixed in 2.2.18 • Packagist sulu/sulu: >= 2.3.0, < 2.3.8 → fixed in 2.3.8 • Packagist sulu/sulu: >= 2.4.0-RC1, < 2.4.0 → fixed in 2.4.0

Impact _What kind of vulnerability is it? Who is impacted?_ An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. • Compromised components: Arbitrary file read on the server, (Potential) Remote code execution • Exploitation pre-requisite: User account on the backend Patches _Has the problem been patched? What versions should users upgrade to?_ The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0 Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language. References _Are there any links users can visit to find out more?_ Currently not. For more information If you have any questions or comments about this advisory: • Open an issue in example link to repo • Email us at example email address