Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS6 AUG
Statamic: Account takeover via OAuth email matching without email-verification check
fixed in 5.74.1 · 6.24.0
Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existence
fixed in 5.74.1 · 6.24.0
5 AUG
Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering
no fix yet
3 AUG
Guzzle: Noncanonical host can bypass host-based checks
fixed in 7.15.2 · 8.0.1
Guzzle: Noncanonical cookie domain keeps subdomain scope
fixed in 7.15.2 · 8.0.1
23 JUL
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
no fix yet
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
no fix yet
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
no fix yet
22 JUL
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem
fixed in 3.1.6
Dompdf: Denial of Service (DoS) via Resource Exhaustion using Oversized Image Bitmaps
fixed in 3.1.6
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
fixed in 3.1.6
Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI
fixed in 3.1.6
Dompdf: File existence oracle via font-face stylesheet declaration
fixed in 3.1.6
21 JUL
guzzlehttp/psr7: Host Confusion via Weak URI Host Validation
fixed in 2.12.3
20 JUL
Guzzle: URI fragments disclosed in redirect Referer headers
fixed in 7.15.1
Guzzle: Host-only cookie scope is not preserved
fixed in 7.15.1
Guzzle: Unbounded response cookies risk denial of service
fixed in 7.15.1
Guzzle: Cookie Disclosure and Injection via IP-Address Domains
fixed in 7.12.3
Guzzle: Proxy-Authorization headers can be sent to origin servers
fixed in 7.14.2
17 JUL
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
fixed in 3.1.28
9 JUL
Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview
no fix yet
Craft CMS has authenticated path traversal in `assets/icon`, allowing local `.svg` file read
no fix yet
7 JUL
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
fixed in 5.3.5
6 JUL
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
fixed in 5.10.0
Craft CMS: Stored XSS via Structure entry title in table view
fixed in 5.9.22
Craft CMS: Sensitive File Disclosure / Server-Side File Read
fixed in 4.18.0 · 5.10.0
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
fixed in 4.17.15 · 5.9.22
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
no fix yet
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.