CVE-2025-22145
1 advisory.
Packagist/nesbot/carbon CVE-2025-22145: medium 6.3, EPSS 0.75%
Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
Action: Upgrade nesbot/carbon to 2.72.6 or later.
composer require nesbot/carbon:3.8.4composer require nesbot/carbon:2.72.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.8.4 | - |
| 0 | 2.72.6 | - |
Fixed versions
| 3.8.4 | 2.72.6 |
Sources
- osv: GHSA-j3f9-p6hm-5w6q
- nvd: CVE-2025-22145
- https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q
- https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58
- https://github.com/CarbonPHP/carbon
- https://lists.debian.org/debian-lts-announce/2025/02/msg00032.html
CVE-2025-22145 · published · modified · JSON