Deserialization Of Untrusted Data

timber/timber is vulnerable to Deserialization of Untrusted Data. The vulnerability due to a lack of input validation before passing it into the file_exists function. An attacker can execute arbitrary code by uploading files of any type to the server which then gets passed in the phar:// protocol to deserialize the uploaded file and instantiate arbitrary PHP objects. This is particularly dangerous when used with frameworks or developer code that have known POP chains, which ran result in remote code execution.