GHSA-6pjm-hmvf-h4rr
image-optimizer allows PHAR deserialization
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | spatie/image-optimizer | < 1.7.3 | 1.7.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the `phar://` protocol in arguments to `file_exists()`.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2024-34515
- https://github.com/spatie/image-optimizer/issues/210
- https://github.com/spatie/image-optimizer/pull/211
- https://github.com/spatie/image-optimizer/commit/89847b55fbb44b3bcde0283bff8cc5abb5e51b82
- https://github.com/spatie/image-optimizer
- https://github.com/spatie/image-optimizer/compare/1.7.2...1.7.3