GHSA-qwvp-g9j7-28f6
froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | froxlor/froxlor | < 2.0.14 | 2.0.14 |
Details
As written in the advisory (Markdown source, shown as plain text).
Image files uploaded in froxlor/froxlor prior to 2.0.14 were not properly validated which could result in remote code execution via path manipulation.
References
External links from the advisory. They lead to third-party sites.