{"action":"Upgrade oneup/uploader-bundle to 1.9.3 or later.","affected":[{"fixed":"2.1.5","introduced":"2.0.0"},{"fixed":"1.9.3","introduced":"1.0.0"}],"component":"oneup/uploader-bundle","cve_ids":["CVE-2020-5237"],"ecosystem":"Packagist","epss":0.03929,"exploited":false,"fixed_versions":["2.1.5","1.9.3"],"ghsa_id":"GHSA-x8wj-6m73-gfqp","id":"tcs_01M5KFAWAH2YYA0S9TABEPCF69","modified_at":"2026-09-10T03:48:27.619057563Z","published_at":"2020-02-18T18:59:24Z","references":["https://osv.dev/vulnerability/GHSA-x8wj-6m73-gfqp","https://github.com/1up-lab/OneupUploaderBundle/security/advisories/GHSA-x8wj-6m73-gfqp","https://nvd.nist.gov/vuln/detail/CVE-2020-5237","https://github.com/1up-lab/OneupUploaderBundle/commit/a6011449b716f163fe1ae323053077e59212350c","https://github.com/FriendsOfPHP/security-advisories/blob/master/oneup/uploader-bundle/CVE-2020-5237.yaml","https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-003.txt"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-x8wj-6m73-gfqp","url":"https://osv.dev/vulnerability/GHSA-x8wj-6m73-gfqp"}],"summary":"Relative Path Traversal (CWE-23) in chunked uploads in oneup/uploader-bundle"}