GHSA-5jgj-h9wp-53fr

Known vulnerable to code execution via SVG file in v1.3.1

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-32115

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	idno/known	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in the isSVG() function of Known v1.3.1 allows attackers to execute arbitrary code via a crafted SVG file. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-32115 advisory
https://github.com/idno/known/commit/80b716a8392fb71cfce84d03aaf7c045c62f6350 web
https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software web
https://github.com/idno/known package
https://github.com/idno/known/blob/dev/composer.json#L4 web
https://withknown.com web