{"action":"Upgrade knplabs/knp-snappy to 1.4.2 or later.","affected":[{"fixed":"1.4.2","introduced":"0"}],"component":"knplabs/knp-snappy","cve_ids":["CVE-2023-28115"],"ecosystem":"Packagist","epss":0.0276,"exploited":false,"fixed_versions":["1.4.2"],"ghsa_id":"GHSA-gq6w-q6wh-jggc","id":"tcs_01M5KF30B2ANYSXZWJSM3Q9JJZ","modified_at":"2026-09-10T03:50:08.071605541Z","published_at":"2023-03-17T18:24:24Z","references":["https://osv.dev/vulnerability/GHSA-gq6w-q6wh-jggc","https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc","https://nvd.nist.gov/vuln/detail/CVE-2023-28115","https://github.com/KnpLabs/snappy/pull/469","https://github.com/KnpLabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6","https://github.com/KnpLabs/snappy/commit/b66f79334421c26d9c244427963fa2d92980b5d3","https://github.com/FriendsOfPHP/security-advisories/blob/master/knplabs/knp-snappy/CVE-2023-28115.yaml","https://github.com/KnpLabs/snappy","https://github.com/KnpLabs/snappy/blob/5126fb5b335ec929a226314d40cd8dad497c3d67/src/Knp/Snappy/AbstractGenerator.php#L670","https://github.com/KnpLabs/snappy/releases/tag/v1.4.2","https://github.com/advisories/GHSA-gq6w-q6wh-jggc","https://huntr.dev/bounties/0bdddc12-ff67-4815-ab9f-6011a974f48e"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-gq6w-q6wh-jggc","url":"https://osv.dev/vulnerability/GHSA-gq6w-q6wh-jggc"}],"summary":"PHAR deserialization allowing remote code execution"}