VDB
Sign up
HIGH7.5

GHSA-8hc2-hvrc-x4qr

phpBB arbitrary CSS injection

Quick fix

GHSA-8hc2-hvrc-x4qr — phpbb/phpbb: upgrade to the fixed version with the command below.

composer require phpbb/phpbb:^3.2.8

Details

phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/phpbb/phpbb
Introduced in: 3.2.7Fixed in: 3.2.8
Fixcomposer require phpbb/phpbb:^3.2.8

References