Packagist/roadiz/documents CVE-2026-33486: medium 6.8
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents
Action: Upgrade roadiz/documents to 2.3.42 or later.
composer require roadiz/documents:2.7.9composer require roadiz/documents:2.6.28composer require roadiz/documents:2.5.44composer require roadiz/documents:2.3.42Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.7.0 | 2.7.9 | - |
| 2.6.0 | 2.6.28 | - |
| 2.4.0 | 2.5.44 | - |
| 0 | 2.3.42 | - |
Fixed versions
| 2.7.9 | 2.6.28 | 2.5.44 | 2.3.42 |
Sources
- osv: GHSA-rc55-58f4-687g
- https://github.com/roadiz/core-bundle-dev-app/security/advisories/GHSA-rc55-58f4-687g
- https://nvd.nist.gov/vuln/detail/CVE-2026-33486
- https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2
- https://github.com/roadiz/core-bundle-dev-app
CVE-2026-33486 · published · modified · JSON