CVE-2024-34515

2024-05-0521:15:55

Google

osv.dev

phar deserialization

file_exists argument

software vulnerability

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().

CPENameOperatorVersion
image-optimizereq1.1.2
image-optimizereq1.6.2
image-optimizereq1.7.1
image-optimizereq1.6.4
image-optimizereq1.7.2
image-optimizereq1.3.1
image-optimizereq1.0.11
image-optimizereq1.3.0
image-optimizereq1.7.0
image-optimizereq1.0.12

Name	Operator	Version
image-optimizer	eq	1.1.2
image-optimizer	eq	1.6.2
image-optimizer	eq	1.7.1
image-optimizer	eq	1.6.4
image-optimizer	eq	1.7.2
image-optimizer	eq	1.3.1
image-optimizer	eq	1.0.11
image-optimizer	eq	1.3.0
image-optimizer	eq	1.7.0
image-optimizer	eq	1.0.12