CVE-2023-41330

knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check if...

CVE-2023-41330

creationtimestamp| type| source ---|---|--- 2023-09-06 22:18:16+00:00| seen| https://t.me/cibsecurity/70031 2023-09-08 12:17:48+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-92rv-4j2h-8mjj...

CVE-2023-41330 Unsafe deserialization in knplabs/knp-snappy

knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check if...

CVE-2023-41330 Unsafe deserialization in knplabs/knp-snappy

knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserialization. Version 1.4.2 added a check if...

CVE-2023-41330

CVE-2023-41330 affects knplabs/knp-snappy (PHP library for thumbnail/snapshot/PDF generation). The issue is a unsafe PHAR deserialization vulnerability related to how output filenames are handled when generateFromHtml() can be controlled and passed to prepareOutput(). Although a patch was added i...