Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security: Arbitrary File Upload Leads to RCE #3570

Closed
abrookbanks opened this issue Apr 24, 2024 · 3 comments
Closed

Security: Arbitrary File Upload Leads to RCE #3570

abrookbanks opened this issue Apr 24, 2024 · 3 comments
Assignees
@abrookbanks
Labels
security
Milestone
6.5.5

Comments

@abrookbanks
Copy link
Member

abrookbanks commented Apr 24, 2024 •
edited
Loading

Many thanks to Julio Araujo (@julio-cfa) for disclosing this vulnerability responsibly.
@abrookbanks abrookbanks self-assigned this Apr 24, 2024
@abrookbanks abrookbanks modified the milestones: 6.5.6, 6.5.5 Apr 24, 2024
abrookbanks added a commit that referenced this issue Apr 24, 2024
@abrookbanks
#3570 - .phar to illegal filenames list
31a5ec3
@julio-cfa
Copy link

Thank you, @abrookbanks! I appreciate the quick fix.

@adrian24dev
Copy link

How can we fix this?

Many thanks to Julio Araujo (@julio-cfa) for disclosing this vulnerability responsibly.

@abrookbanks
Copy link
Member Author

Upgrade to the latest version or apply the code changes in this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@abrookbanks abrookbanks

Labels
security
Projects
None yet
Milestone
6.5.5
Development

No branches or pull requests
3 participants
@abrookbanks @julio-cfa @adrian24dev