GHSA-2hw6-4rv9-82fp
Uvdesk remote code execution vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | uvdesk/community-skeleton | <= 1.1.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
References
External links from the advisory. They lead to third-party sites.