What is GHSA-6rgh-r6j3-3223?

GHSA-6rgh-r6j3-3223 is a security advisory published by GitHub Security Advisories with Medium severity. czim/file-handling vulnerable to SSRF and directory traversal

Which CVE IDs does GHSA-6rgh-r6j3-3223 cover?

GHSA-6rgh-r6j3-3223 covers the following CVE IDs: CVE-2024-47049. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6rgh-r6j3-3223?

GHSA-6rgh-r6j3-3223 has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-6rgh-r6j3-3223?

GHSA-6rgh-r6j3-3223 affects 2 products, including: composer/czim/file-handling:\u003c 1.5.0; composer/czim/file-handling:\u003e= 2.0.0, \u003c 2.3.0.

GHSA-6rgh-r6j3-3223MediumCVSS 8.2

czim/file-handling vulnerable to SSRF and directory traversal

Vendor

GitHub Security Advisories

Published

September 17, 2024

Last Modified

September 27, 2024

🔗 CVE IDs covered (1)

CVE-2024-47049 →

📋 Description

The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

🎯 Affected products2

composer/czim/file-handling:< 1.5.0
composer/czim/file-handling:>= 2.0.0, < 2.3.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-47049
https://github.com/czim/file-handling/blob/2.3.0/SECURITY.md
https://github.com/czim/file-handling/commit/95dfda850536bf35e684619598b9d02f4c97680d
https://github.com/czim/file-handling/commit/dcf879896efe3457f51af9c8eab9f70dfc709a99
https://github.com/advisories/GHSA-6rgh-r6j3-3223