Threats Tagged 'packagist'

Leantime versions prior to 3.10.0 contain a critical vulnerability allowing any authenticated user, including those with the lowest privilege (readonly), to escalate to full administrative access via unauthorized JSON-RPC methods. This occurs because certain JSON-RPC service methods lack proper per-method authorization checks, enabling privilege escalation and unauthorized plugin management. The vulnerability allows creation of admin accounts without authorization and bypasses web UI role checks. A proof-of-concept demonstrates full admin access gained from a low-privilege session. The CVSS 3.1 score is 8.8 (high severity). A patch is available.

YOURLS versions prior to 1.10.5 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server. This occurs because URL sanitization functions do not properly filter filesystem path traversal sequences, enabling attackers to bypass restrictions and execute code without credentials. The vulnerability can be exploited by requesting crafted URLs containing '../' sequences, leading to remote code execution if a malicious PHP file is present on the server.

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before cleanHrefAttributes() normalizes mixed-case names. An attacker can provide xlink:HrEf on nested <use> elements so the graph omits those references, after which the sanitizer converts the attribute to canonical xlink:href and returns the live nesting structure without applying the useNestingLimit protection. A consuming application that renders the sanitized SVG can therefore be exposed to the resource exhaustion that control is designed to prevent. This issue is fixed in version 1.0.0.

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.

PHPCSUtils versions 1.0.0-alpha1 through 1.2.2 contain a remote code execution vulnerability due to improper neutralization of directives in dynamically evaluated code. The vulnerability exists in the AbstractArrayDeclarationSniff::getActualArrayKey() method, which uses eval() on array keys, allowing execution of arbitrary PHP code. This affects any sniff extending AbstractArrayDeclarationSniff, including some in PHPCSExtra. The issue is fixed in version 1.2.3. Users who cannot upgrade immediately can mitigate risk by disabling the vulnerable sniffs via custom ruleset exclusions.

A vulnerability in Contao core bundle allows disclosure of protected page titles, URLs, and indexed text to unauthenticated visitors via site search when the setting contao.search.index_protected is disabled. The pages themselves remain access-controlled and do not allow unauthorized access. This issue affects versions from 4.0.0 up to but not including 5.3.50 and from 5.4.0-RC1 up to but not including 5.7.12. A patch is available to address this information disclosure.

A vulnerability in Contao core bundle's registration module allows unlimited resending of activation emails without rate limiting. This can be exploited by anyone on the internet to send unlimited emails from the site, potentially harming the site's email reputation and revealing if an address has a pending registration. The issue affects versions from 4.1.0 up to but not including 5.3.50, and from 5.4.0-RC1 up to but not including 5.7.12. A patch is available to address this issue.

CVE-2026-107848 is a cross-site request forgery (CSRF) vulnerability in the Contao core bundle affecting backend actions dispatched via a 'key=' parameter. The generic CSRF token validator only protects POST requests, while GET requests with 'key=' actions lack CSRF protection. An authenticated backend user who loads a malicious URL can unknowingly trigger backend actions without token validation or confirmation. Verified vulnerable actions are destructive or state-changing but do not escalate privileges. The vulnerability affects Contao versions from 4.0.0 up to but not including 5.3.50, and from 5.4.0-RC1 up to but not including 5.7.12. A patch is available to address this issue.

A path traversal vulnerability exists in the Contao core bundle's ImagesController that allows unauthenticated attackers to read files outside the intended image directory if the files have certain image extensions. The vulnerability arises because the path joining logic does not verify that the resolved path remains within the configured image directory. This can disclose files anywhere under the project directory with extensions such as jpg, png, svg, and others. The vulnerability also allows an existence oracle for arbitrary paths and may reveal absolute filesystem paths in debug mode. However, attempts to read files below the upload directory return errors, limiting the practical impact.

CVE-2026-107845 is a critical cross-site scripting (XSS) vulnerability in the Contao comments bundle that allows unauthenticated front end visitors to inject malicious scripts in comments. These scripts execute in the context of any back end user who opens the Comments module, without requiring any user interaction. The lack of a Content-Security-Policy header on the Contao back end allows inline script execution. This can lead to full back end compromise, including reading modules, creating administrators, or editing templates that enable code execution. Moderation does not prevent exposure and actually guarantees it since unpublished comments are still loaded by moderators. A patch is available for affected versions.