Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS6 JUL
Craft CMS: Potential authenticated Remote Code Execution via referrer redirect
fixed in 5.10.0
Craft CMS: Stored XSS via Structure entry title in table view
fixed in 5.9.22
Craft CMS: Sensitive File Disclosure / Server-Side File Read
fixed in 4.18.0 · 5.10.0
Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget
fixed in 4.17.15 · 5.9.22
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
no fix yet
Formie Hidden field defaults vulnerable to Server-Side Template Injection
fixed in 3.1.27
5 JUL
Pricing Rules Relationship 1.0.3 is a critical release
fixed in 1.0.3
2 JUL
Craft CMS Vulnerable to Unauthorized Deletion of Destination Folders During Forced Moves
fixed in 4.17.14 · 5.9.21
Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements
fixed in 5.9.21
Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
fixed in 4.17.15 · 5.9.22
Craft CMS: Unauthorized Deletion of Source Assets During File Replacement
fixed in 4.17.14 · 5.9.21
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
fixed in 5.9.21
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
fixed in 5.9.21
1 JUL
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
no fix yet
26 JUN
Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editors
fixed in 5.74.0 · 6.20.3
Statamic Vulnerable to CSV formula injection in form submission exports
fixed in 5.73.24 · 6.20.1
Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)
fixed in 5.73.24 · 6.20.1
Statamic CMS's unsafe method invocation via collection sorting allows data destruction
fixed in 5.73.23 · 6.20.0
Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources
fixed in 5.73.23 · 6.20.0
25 JUN
Tiptap contains an input validation vulnerability resulting in DoS
fixed in 2.1.1
19 JUN
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
fixed in 4.18 · 5.10
18 JUN
CRLF injection in HTTP start-line serialization
fixed in 2.12.1
17 JUN
Laravel Framework: Temporary Signed URL Path Confusion
fixed in 12.61.1 · 13.12.0
Laravel Framework: CRLF injection in default email rule
fixed in 12.60.0
15 JUN
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)
fixed in 7.5.16
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
fixed in 0.1.24
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
fixed in 8.0.16
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows
fixed in 2.14.1
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.