{"action":"Upgrade endroid/qr-code-bundle to 3.4.2 or later.","affected":[{"fixed":"3.4.2","introduced":"0"}],"component":"endroid/qr-code-bundle","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["3.4.2"],"ghsa_id":"GHSA-mvf6-3f2g-xfxf","id":"tcs_01M5KF5VRSZ5D304QAJFGF66EW","modified_at":"2024-11-29T05:37:08.887462Z","published_at":"2024-05-15T21:05:13Z","references":["https://osv.dev/vulnerability/GHSA-mvf6-3f2g-xfxf","https://github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8","https://github.com/FriendsOfPHP/security-advisories/blob/master/endroid/qr-code-bundle/2019-12-22.yaml","https://github.com/endroid/qr-code-bundle","https://github.com/endroid/qr-code-bundle/releases/tag/3.4.2"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-mvf6-3f2g-xfxf","url":"https://osv.dev/vulnerability/GHSA-mvf6-3f2g-xfxf"}],"summary":"endroid/qr-code-bundle File Disclosure via logo_path query parameter"}