What is GHSA-44m4-9cjp-j587?

GHSA-44m4-9cjp-j587 is a security advisory published by GitHub Security Advisories with High severity. IBX-1392: Image filenames sanitization

Why does GHSA-44m4-9cjp-j587 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-44m4-9cjp-j587?

GHSA-44m4-9cjp-j587 affects 1 product, including: composer/ezsystems/ezpublish-kernel:\u003e= 7.5.0, \u003c 7.5.26.

GHSA-44m4-9cjp-j587HighDisclosed before NVD

IBX-1392: Image filenames sanitization

Vendor

GitHub Security Advisories

Published

January 21, 2022

Last Modified

January 11, 2023

📋 Description

ezsystems/ezpublish-kernel versions 7.5.* before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files.

🎯 Affected products1

composer/ezsystems/ezpublish-kernel:>= 7.5.0, < 7.5.26

🔗 References (4)

https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-44m4-9cjp-j587
https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization
https://github.com/ezsystems/ezpublish-kernel/releases/tag/v7.5.26
https://github.com/advisories/GHSA-44m4-9cjp-j587