{"action":"Upgrade cakephp/cakephp to 2.0.99 or later.","affected":[{"fixed":"2.0.99","introduced":"2.0.0"},{"fixed":"2.1.99","introduced":"2.1.0"},{"fixed":"2.2.99","introduced":"2.2.0"},{"fixed":"2.3.99","introduced":"2.3.0"},{"fixed":"2.4.99","introduced":"2.4.0"},{"fixed":"2.5.99","introduced":"2.5.0"},{"fixed":"2.6.12","introduced":"2.6.0"},{"fixed":"2.7.6","introduced":"2.7.0"},{"fixed":"3.0.15","introduced":"3.0.0"},{"fixed":"3.1.4","introduced":"3.1.0"}],"component":"cakephp/cakephp","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.0.99","2.1.99","2.2.99","2.3.99","2.4.99","2.5.99","2.6.12","2.7.6","3.0.15","3.1.4"],"ghsa_id":"GHSA-p76f-wr22-4rv6","id":"tcs_01M5KF65AVG1SSZKFXSNBNGQWP","modified_at":"2024-11-29T05:41:07.154891Z","published_at":"2023-01-20T23:35:01Z","references":["https://osv.dev/vulnerability/GHSA-p76f-wr22-4rv6","https://github.com/cakephp/cakephp/commit/5e60cc5d182e6131e3fbdfdf69f49d560c9ff78b","https://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-11-05.yaml","https://github.com/cakephp/cakephp"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-p76f-wr22-4rv6","url":"https://osv.dev/vulnerability/GHSA-p76f-wr22-4rv6"}],"summary":"CakePHP vulnerable to Remote File Inclusion through View template name manipulation"}