~ / search / GHSA-qx95-cwh6-9mvq

GHSA-qx95-cwh6-9mvq

TCPDF missing character escape on error messages

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-56527

Packages

EcosystemPackageAffectedFixed in
Packagist tecnickcom/tcpdf < 6.8.0 6.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

References

External links from the advisory. They lead to third-party sites.