CVE-2024-24752

Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a RequestHandlerInterface, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPart, each part is parsed and for each whic...

CVE-2024-24752

Bref CVE-2024-24752 affects AWS Lambda deployments using Bref with the Event-Driven Function runtime and a RequestHandlerInterface. During multipart handling, uploaded parts that are files are saved to /tmp with random names starting bref_upload_ and are not deleted after the request is processed...