{"action":"Upgrade neos/flow to 2.3.7 or later.","affected":[{"fixed":"2.3.7","introduced":"2.3.0"},{"fixed":"3.0.1","introduced":"3.0.0"}],"component":"neos/flow","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.3.7","3.0.1"],"ghsa_id":"GHSA-5vv7-j593-mgjc","id":"tcs_01M5KEWE1FKT8N0CRT5BBV5V7Z","modified_at":"2024-12-02T05:27:13.868067Z","published_at":"2024-05-17T22:54:42Z","references":["https://osv.dev/vulnerability/GHSA-5vv7-j593-mgjc","https://github.com/FriendsOfPHP/security-advisories/blob/master/neos/flow/2015-11-23.yaml","https://github.com/neos/flow","https://www.neos.io/blog/flow-sa-2015-001.html"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-5vv7-j593-mgjc","url":"https://osv.dev/vulnerability/GHSA-5vv7-j593-mgjc"}],"summary":"Neos Flow Arbitrary file upload and XML External Entity processing"}