{"action":"Upgrade ibexa/post-install to 1.0.4.1 or later.","affected":[{"fixed":"1.0.4.1","introduced":"0"}],"component":"ibexa/post-install","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["1.0.4.1"],"ghsa_id":"GHSA-gqcf-83rq-gpfr","id":"tcs_01M5KF30ZK40MWRGFE788XS629","modified_at":"2024-12-02T05:28:17.830949Z","published_at":"2021-09-14T20:24:44Z","references":["https://osv.dev/vulnerability/GHSA-gqcf-83rq-gpfr","https://github.com/ibexa/post-install/security/advisories/GHSA-gqcf-83rq-gpfr","https://developers.ibexa.co/security-advisories/ibexa-sa-2021-006-storage-and-legacy-files-accessible-if-path-is-known","https://github.com/ibexa/post-install"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-gqcf-83rq-gpfr","url":"https://osv.dev/vulnerability/GHSA-gqcf-83rq-gpfr"}],"summary":"Any storage file can be downloaded from p.sh if full server path is known"}