~ / search / GHSA-5rwm-2xw8-hh9p

GHSA-5rwm-2xw8-hh9p

Deserialization of Untrusted Data in Torrentpier

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-1651

Packages

EcosystemPackageAffectedFixed in
Packagist torrentpier/torrentpier <= 2.4.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization.

References

External links from the advisory. They lead to third-party sites.