GHSA-6rgh-r6j3-3223

czim/file-handling vulnerable to SSRF and directory traversal

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-47049

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	czim/file-handling	< 1.5.0	1.5.0
Packagist	czim/file-handling	>= 2.0.0, < 2.3.0	2.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-47049 advisory
https://github.com/czim/file-handling/commit/95dfda850536bf35e684619598b9d02f4c97680d web
https://github.com/czim/file-handling/commit/dcf879896efe3457f51af9c8eab9f70dfc709a99 web
https://github.com/czim/file-handling package
https://github.com/czim/file-handling/blob/2.3.0/SECURITY.md web