medium6.3

CVE-2025-22145

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Impact

### Impact Application passing unsanitized user input to `Carbon::setLocale` are at risk of arbitrary file include, if the application allows users to upload files with `.php` extension in an folder that allows `include` or `require` to read it, then they are at risk of arbitrary code ran on their servers. ### Patches - [3.8.4](https://github.com/briannesbitt/Carbon/releases/tag/3.8.4) - [2.72.6](https://github.com/briannesbitt/Carbon/releases/tag/2.72.6) ### Workarounds Any of the below actions can be taken to prevent the issue: - Validate input before calling `setLocale()`, for instance by forbidding or removing `/` and `\` - Call `setLocale()` only with a locale from a whitelist of supported locales - When uploading files, rename them so they cannot have a `.php` extension (this is recommended even if you're not affected by this issue) - Prefer storage system that are not local to the application (remote service, or local service ran by another user so the uploaded files actually live outside of the application basedir) ### References https://en.wikipedia.org/wiki/File_inclusion_vulnerability ### Credits Thanks to **Szczepan Hołyszewski** who reported the issue and to Tidelift to coordinate the resolution

Affected packages

Ecosystem	Package	Affected	Fixed in
composer	`nesbot/carbon`	>= 3.0.0, < 3.8.4	3.8.4

Weakness classification

CWE-98