HIGH

GHSA-26hp-cgjj-m2j3

fuel/core ImageMagick driver does not escape all shell arguments.

Quick fix

GHSA-26hp-cgjj-m2j3 — fuel/core: upgrade to the fixed version with the command below.

composer require fuel/core:^1.8.0.4

Details

This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/fuel/core

Introduced in: 0Fixed in: 1.8.0.4

Fixcomposer require fuel/core:^1.8.0.4

References

https://github.com/fuel/core/commit/95c134e9e087f3c4523fe6cd86ed4e9e1e7af91c[WEB]
https://fuelphp.com/security-advisories[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/fuel/core/2016-06-29-1.yaml[WEB]
https://github.com/fuel/core[PACKAGE]