laravel-backpack/filemanager · Security
FileManager Deserialization of Untrusted Data vulnerability
- GHSA ID
- GHSA-8237-957h-h2c2
- CVE ID
- CVE-2024-52306
- Severity
- high
- Published
- Updated
- CVSS
- 7.6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
- CVSS v3
- 7.6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
- CVSS v4
- 8.5 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Impact
Deserialization of untrusted data from the mimes parameter could lead to remote code execution.
Patches
Fixed in 3.0.9
Workarounds
Not needed, a composer update will solve it in a non-breaking way.
References
Reported responsibly Vladislav Gladkiy at Positive Technologies.
CWEs
- CWE-502 · Deserialization of Untrusted Data