GHSA-8237-957h-h2c2
FileManager Deserialization of Untrusted Data vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | backpack/filemanager | >= 3.0.0, < 3.0.9 | 3.0.9 |
| Packagist | backpack/filemanager | < 2.0.2 | 2.0.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Deserialization of untrusted data from the `mimes` parameter could lead to remote code execution.
### Patches
Fixed in 3.0.9
### Workarounds
Not needed, a `composer update` will solve it in a non-breaking way.
### References
Reported responsibly [Vladislav Gladkiy](https://github.com/catferq) at [Positive Technologies](https://www.ptsecurity.com/ww-en/).
References
External links from the advisory. They lead to third-party sites.