~ / search / GHSA-g377-x8rg-c9mf

GHSA-g377-x8rg-c9mf

Deserialization of Untrusted Data in topthink/framework

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-33107

Packages

EcosystemPackageAffectedFixed in
Packagist topthink/framework <= 6.0.12 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

References

External links from the advisory. They lead to third-party sites.