Lucene search

GitHub Advisory DatabaseGHSA-6PJM-HMVF-H4RR

HistoryMay 05, 2024 - 9:30 p.m.

image-optimizer allows PHAR deserialization

2024-05-0521:30:31

GitHub Advisory Database

github.com

image optimizer

vulnerability

phar deserialization

protocol

file manipulation

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().

Affected configurations

Vulners

Node

spatiebrowsershotRange<1.7.3

CPENameOperatorVersion
spatie/image-optimizerlt1.7.3

CPE	Name	Operator	Version
	spatie/image-optimizer	lt	1.7.3

github.com/advisories/GHSA-6pjm-hmvf-h4rr

github.com/spatie/image-optimizer/commit/89847b55fbb44b3bcde0283bff8cc5abb5e51b82

github.com/spatie/image-optimizer/compare/1.7.2...1.7.3

github.com/spatie/image-optimizer/issues/210

github.com/spatie/image-optimizer/pull/211

nvd.nist.gov/vuln/detail/CVE-2024-34515