{"action":"Upgrade ezsystems/ezpublish-legacy to 5.3.12.6 or later.","affected":[{"fixed":"2018.9.1.3","introduced":"2018.9.0"},{"fixed":"2018.6.1.4","introduced":"2018.6.0"},{"fixed":"2017.12.4.3","introduced":"2011.0.0"},{"fixed":"5.4.12.3","introduced":"5.4.0"},{"fixed":"5.3.12.6","introduced":"5.3.0"}],"component":"ezsystems/ezpublish-legacy","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2018.9.1.3","2018.6.1.4","2017.12.4.3","5.4.12.3","5.3.12.6"],"ghsa_id":"GHSA-pqjm-xcp8-wgmm","id":"tcs_01M5KF6KF4DJPFJ6A03SP0K31J","modified_at":"2024-11-29T05:44:57.691639Z","published_at":"2024-05-15T21:31:07Z","references":["https://osv.dev/vulnerability/GHSA-pqjm-xcp8-wgmm","https://github.com/ezsystems/ezplatform/commit/9a0c52dc4535e4b3ce379f80222dc53f705a2cfd","https://github.com/ezsystems/ezpublish-legacy/commit/d21957bf202b091ab39dfb5be300f6c30be3933e","https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-21-1.yaml","https://github.com/ezsystems/ezpublish-legacy","https://web.archive.org/web/20210614192208/https://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads","http://share.ez.no/community-project/security-advisories/ezsa-2018-009-do-not-interpret-php-phar-uploads"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-pqjm-xcp8-wgmm","url":"https://osv.dev/vulnerability/GHSA-pqjm-xcp8-wgmm"}],"summary":"Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads"}