What is GHSA-3fvf-2gp4-89wq?

GHSA-3fvf-2gp4-89wq is a security advisory published by GitHub Security Advisories with Medium severity. Possibility for Denial of Service by overwriting PHP files with language exports

Why does GHSA-3fvf-2gp4-89wq have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-3fvf-2gp4-89wq?

GHSA-3fvf-2gp4-89wq affects 1 product, including: composer/barryvdh/laravel-translation-manager:\u003c 0.6.2.

GHSA-3fvf-2gp4-89wqMediumDisclosed before NVD

Possibility for Denial of Service by overwriting PHP files with language exports

Vendor

GitHub Security Advisories

Published

March 18, 2022

Last Modified

January 11, 2023

📋 Description

Impact

Laravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.

Patches

Version 0.6.2 fixes this issue.

Workarounds

Only allow trusted admins to publish/edit translations.

References

https://github.com/barryvdh/laravel-translation-manager/pull/417

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/barryvdh/laravel-translation-manager
Email me (see Github profile)

Credits

Found and reported by Natalia Trojanowska

🎯 Affected products1

composer/barryvdh/laravel-translation-manager:< 0.6.2