Advisories
Security advisories for PHP and JavaScript packages.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS24 MAR
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
no fix yet
Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior
no fix yet
19 MAR
league/commonmark has an embed extension allowed_domains bypass
no fix yet
18 MAR
Statamic is missing authorization check on taxonomy term creation via fieldtype
fixed in 5.73.14 · 6.7.0
Statamic has a path traversal in file dictionary fieldtype
fixed in 5.73.14 · 6.7.0
Statamic has Stored XSS via SVG Sanitization Bypass
fixed in 5.73.14 · 6.7.0
Craft CMS Vulnerable to Stored XSS in Revision Context Menu
no fix yet
16 MAR
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
no fix yet
Amazon S3 for Craft CMS has an Information Disclosure vulnerability
no fix yet
Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController
no fix yet
Craft CMS vulnerable to behavior injection RCE via EntryTypesController
no fix yet
Craft CMS has a Path Traversal Vulnerability in AssetsController
no fix yet
13 MAR
Statamic vulnerable to privilege escalation via stored cross-site scripting
fixed in 6.6.2
11 MAR
Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page
no fix yet
CraftCMS has an RCE vulnerability via relational conditionals in the control panel
no fix yet
CraftCMS's `ElementSearchController` Affected by Blind SQL Injection
no fix yet
CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization
no fix yet
10 MAR
Craft CMS has a potential information disclosure vulnerability in preview tokens
fixed in 4.17.3 · 5.9.7
Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation
fixed in 5.2.4
6 MAR
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
no fix yet
5 MAR
4 MAR
Craft CMS has unauthenticated activation email trigger with potential user enumeration
fixed in 4.17.0-beta.2 · 5.9.0-beta.2
3 MAR
Craft CMS has potential authenticated Remote Code Execution via Twig SSTI
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS has Permission Bypass and IDOR in Duplicate Entry Action
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS has Twig Function Blocklist Bypass
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS: Entries Authorship Spoofing via Mass Assignment
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Craft CMS has IDOR via GraphQL @parseRefs
fixed in 4.17.0-beta.1 · 5.9.0-beta.1
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.