CVE-2023-28115

Packagist/knplabs/knp-snappy CVE-2023-28115: critical 9.8

PHAR deserialization allowing remote code execution

Action: Upgrade knplabs/knp-snappy to 1.4.2 or later.

composer require knplabs/knp-snappy:1.4.2

Affected

Fixed versions

Sources

• osv: GHSA-gq6w-q6wh-jggc
• https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc
• https://nvd.nist.gov/vuln/detail/CVE-2023-28115
• https://github.com/KnpLabs/snappy/pull/469
• https://github.com/KnpLabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6
• https://github.com/KnpLabs/snappy/commit/b66f79334421c26d9c244427963fa2d92980b5d3
• https://github.com/FriendsOfPHP/security-advisories/blob/master/knplabs/knp-snappy/CVE-2023-28115.yaml
• https://github.com/KnpLabs/snappy
• https://github.com/KnpLabs/snappy/blob/5126fb5b335ec929a226314d40cd8dad497c3d67/src/Knp/Snappy/AbstractGenerator.php#L670
• https://github.com/KnpLabs/snappy/releases/tag/v1.4.2
• https://github.com/advisories/GHSA-gq6w-q6wh-jggc
• https://huntr.dev/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e

CVE-2023-28115 · published 2023-03-17T18:24:24Z · modified 2026-09-10T03:50:08.071605541Z · JSON