What is GHSA-qq2h-m2hj-hrff?

GHSA-qq2h-m2hj-hrff is a security advisory published by GitHub Security Advisories with Critical severity. DevDojo Voyager Argument Injection vulnerability

Which CVE IDs does GHSA-qq2h-m2hj-hrff cover?

GHSA-qq2h-m2hj-hrff covers the following CVE IDs: CVE-2025-32931. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qq2h-m2hj-hrff?

GHSA-qq2h-m2hj-hrff has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-qq2h-m2hj-hrff?

GHSA-qq2h-m2hj-hrff affects 1 product, including: composer/tcg/voyager:\u003e= 1.4.0, \u003c= 1.8.0.

GHSA-qq2h-m2hj-hrffCriticalCVSS 9.1

DevDojo Voyager Argument Injection vulnerability

Vendor

GitHub Security Advisories

Published

April 14, 2025

Last Modified

April 14, 2025

🔗 CVE IDs covered (1)

CVE-2025-32931 →

📋 Description

DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.

🎯 Affected products1

composer/tcg/voyager:>= 1.4.0, <= 1.8.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-32931
https://github.com/lishihihi/voyager-issue-report
https://github.com/thedevdojo/voyager/blob/1.8/docs/core-concepts/compass.md
https://github.com/thedevdojo/voyager/blob/7e7e0f4f0e115d2d9e0481a86153a1ceff194c00/resources/views/compass/includes/commands.blade.php#L11-L16
https://github.com/advisories/GHSA-qq2h-m2hj-hrff