image-optimizer allows PHAR deserialization

2024-05-0521:30:31

Google

osv.dev

image-optimizer

phar

deserialization

vulnerability

protocol

file_exists

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

JSON

image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().

CPENameOperatorVersion
spatie/image-optimizereq1.0.14
spatie/image-optimizereq1.2.1
spatie/image-optimizereq1.0.8
spatie/image-optimizereq0.0.4
spatie/image-optimizereq1.1.1
spatie/image-optimizereq0.0.2
spatie/image-optimizereq1.0.9
spatie/image-optimizereq0.0.3
spatie/image-optimizereq1.4.0
spatie/image-optimizereq1.6.1

Name	Operator	Version
spatie/image-optimizer	eq	1.0.14
spatie/image-optimizer	eq	1.2.1
spatie/image-optimizer	eq	1.0.8
spatie/image-optimizer	eq	0.0.4
spatie/image-optimizer	eq	1.1.1
spatie/image-optimizer	eq	0.0.2
spatie/image-optimizer	eq	1.0.9
spatie/image-optimizer	eq	0.0.3
spatie/image-optimizer	eq	1.4.0
spatie/image-optimizer	eq	1.6.1