HighGHSA-c697-r227-pq6hCVE-2022-0263

Unrestricted Upload of File with Dangerous Type in pimcore

Published 21 Jan 2022 · Updated 8 Nov 2023

Affected package

pimcore/pimcoreComposer

Affected: <10.2.7
Fixed in: 10.2.7

Update to the fixed version for your release line, for example:composer require pimcore/pimcore:^10.2.7

Details

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore

Is GHSA-c697-r227-pq6h in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected pimcore/pimcore, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2022-0263
Linkgithub.com/pimcore/pimcore/commit/35d1853baf64d6a1d90fd8803e52439da53a3911
Packagegithub.com/pimcore/pimcore
Linkhuntr.dev/bounties/96506857-06bc-4c84-88b7-4f397715bcf6

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.