GitHub Advisoryadvisory · Packagist
GHSA-wq43-8r5p-w3mc contao/core PHP object injection vulnerability allows for arbitrary code execution
HIGH
Official page ↗
- Ecosystem
- Packagist
- Packages
- contao/core
- Severity
- High
- Reviewed
- 2024-05-15
Affected packages
• Packagist contao/core: >= 2.0.0, < 2.11.14 → fixed in 2.11.14
• Packagist contao/core: >= 3.0.0, < 3.2.5 → fixed in 3.2.5
Description
PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to `deserialize()` function.
References
- https://github.com/contao/core/issues/6695 web
- https://github.com/contao/core/commit/d67c46c1f1283134e3050244cfdda0ef26fa5cd4 web
- https://github.com/contao/core/commit/f939b5be8a0048ef779def3289e2072febef1b37 web
- https://contao.org/en/news/major-security-hole-found-in-contao.html web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/2014-02-13.yaml web