~ / search / GHSA-364w-9g92-3grq

GHSA-364w-9g92-3grq

Withdrawn on 2021-11-17. GitHub withdrew this advisory; it no longer applies.

Withdrawn: Laravel Framework does not sufficiently block the upload of executable PHP content.

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-43617

Packages

EcosystemPackageAffectedFixed in
Packagist laravel/framework <= 8.70.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

# Withdrawn This advisory has been withdrawn after the maintainers of Laravel noted this issue is not a security vulnerability with Laravel itself, but rather a userland issue. ## Original CVE based description Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. In some use cases, this may be related to file-type validation for image upload (e.g., differences between getClientOriginalExtension and other approaches).

References

External links from the advisory. They lead to third-party sites.