high8.8
CVE-2024-34515
image-optimizer allows PHAR deserialization
Impact
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the `phar://` protocol in arguments to `file_exists()`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | spatie/image-optimizer | < 1.7.3 | 1.7.3 |
Affected products
| Product | Affected versions |
|---|---|
| Image-Optimizer | before 1.7.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/spatie/image-optimizer/compare/1.7.2...1.7.3
- https://github.com/spatie/image-optimizer/issues/210
- https://github.com/spatie/image-optimizer/pull/211
- https://github.com/advisories/GHSA-6pjm-hmvf-h4rr
- https://nvd.nist.gov/vuln/detail/CVE-2024-34515
- https://github.com/spatie/image-optimizer/commit/89847b55fbb44b3bcde0283bff8cc5abb5e51b82