high7.6
CVE-2024-52306
FileManager Deserialization of Untrusted Data vulnerability
Impact
### Impact Deserialization of untrusted data from the `mimes` parameter could lead to remote code execution. ### Patches Fixed in 3.0.9 ### Workarounds Not needed, a `composer update` will solve it in a non-breaking way. ### References Reported responsibly [Vladislav Gladkiy](https://github.com/catferq) at [Positive Technologies](https://www.ptsecurity.com/ww-en/).
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | backpack/filemanager | >= 3.0.0, < 3.0.9 | 3.0.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Backpackforlaravel | Filemanager | before 2.0.2 from 3.0.0 before 3.0.9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Laravel-Backpack/FileManager/commit/2830498b85e05fb3c92179053b4d7c4a0fdb880b
- https://github.com/Laravel-Backpack/FileManager/security/advisories/GHSA-8237-957h-h2c2
- https://github.com/advisories/GHSA-8237-957h-h2c2
- https://nvd.nist.gov/vuln/detail/CVE-2024-52306