Publish GHSA-j3f9-p6hm-5w6q

2026-05-22 18:04:22 -07:00 · 2025-01-08 21:05:17 +00:00
parent 49a70ccc8f
commit 6e5c96e89c
1 changed files with 80 additions and 0 deletions
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j3f9-p6hm-5w6q",
+  "modified": "2025-01-08T21:03:28Z",
+  "published": "2025-01-08T21:03:28Z",
+  "aliases": [
+    "CVE-2025-22145"
+  ],
+  "summary": "Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale",
+  "details": "### Impact\nApplication passing unsanitized user input to `Carbon::setLocale` are at risk of arbitrary file include, if the application allows users to upload files with `.php` extension in an folder that allows `include` or `require` to read it, then they are at risk of arbitrary code ran on their servers.\n\n### Patches\n- [3.8.4](https://github.com/briannesbitt/Carbon/releases/tag/3.8.4)\n- [2.72.6](https://github.com/briannesbitt/Carbon/releases/tag/2.72.6)\n\n### Workarounds\nAny of the below actions can be taken to prevent the issue:\n- Validate input before calling `setLocale()`, for instance by forbidding or removing `/` and `\\`\n- Call `setLocale()` only with a locale from a whitelist of supported locales\n- When uploading files, rename them so they cannot have a `.php` extension (this is recommended even if you're not affected by this issue)\n- Prefer storage system that are not local to the application (remote service, or local service ran by another user so the uploaded files actually live outside of the application basedir)\n\n### References\nhttps://en.wikipedia.org/wiki/File_inclusion_vulnerability\n\n### Credits\nThanks to **Szczepan Hołyszewski** who reported the issue and to Tidelift to coordinate the resolution",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "nesbot/carbon"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.8.4"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "nesbot/carbon"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.72.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/CarbonPHP/carbon"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-98"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-08T21:03:28Z",
+    "nvd_published_at": null
+  }
+}