Advisories
Composer and PHP security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS6 MAY
Craft CMS's Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure
fixed in 5.9.18
Craft CMS has Potential Authenticated Remote Code Execution via Malicious Attached Behavior
fixed in 4.17.12 · 5.9.18
Craft CMS's Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure
fixed in 4.17.12 · 5.9.18
5 MAY
webonyx/graphql-php has unbounded recursion in parser that causes stack overflow on crafted nested input
no fix yet
4 MAY
webonyx/graphql-php has quadratic validation cost in OverlappingFieldsCanBeMerged via inline fragments
fixed in 15.32.2
29 APR
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions
no fix yet
PhpSpreadsheet has CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader
no fix yet
PhpSpreadsheet has SSRF/RCE in IOFactory::load when $filename is user controlled
no fix yet
28 APR
PhpSpreadsheet has XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer
no fix yet
PhpSpreadsheet has XSS via NumberFormat @ Text Substitution in HTML Writer
no fix yet
22 APR
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
fixed in 12.5.22 · 13.1.6
20 APR
Cross-site scripting (XSS) via script break-out in toScript() output
fixed in 3.23.2 · 4.0.2
17 APR
Argument injection via newline in PHP INI values forwarded to child processes
fixed in 12.5.22 · 13.1.6
16 APR
Statamic: Unsafe method invocation via query value resolution allows data destruction
fixed in 5.73.20 · 6.13.0
14 APR
Craft CMS has a host header injection leading to SSRF via resource-js endpoint
no fix yet
Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations
no fix yet
Craft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action
fixed in 5.9.15
graphql-php is affected by a Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation
no fix yet
10 APR
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
fixed in 1.0.10
27 MAR
AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters
no fix yet
26 MAR
Statamic allows unauthorized content access through missing authorization in its revision controllers
fixed in 5.73.16 · 6.7.2
Statamic's sensitive configuration values are exposed to content editors via Antlers-enabled fields
fixed in 5.73.16 · 6.7.2
Statamic has an Open Redirect on unauthenticated endpoints via URL parsing differential
fixed in 5.73.16 · 6.7.2
Statamic's live preview token bypasses content protection for unrelated entries
fixed in 5.73.16 · 6.7.2
Statamic has Reflected XSS via unescaped redirect parameter in its password reset form tag
fixed in 5.73.16 · 6.7.2
Statamic's Markdown preview endpoint exposes sensitive user data
fixed in 5.73.16 · 6.7.2
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
no fix yet
24 MAR
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
no fix yet
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
no fix yet
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
no fix yet
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.