HIGH7.2

GHSA-rhc2-23c2-ww7c

Remote code execution in web server context

Quick fix

GHSA-rhc2-23c2-ww7c — aimeos/aimeos-core: upgrade to the fixed version with the command below.

composer require aimeos/aimeos-core:^2024.04.5

Details

### Impact User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/aimeos/aimeos-core

Introduced in: 2024.04.1Fixed in: 2024.04.5

Fixcomposer require aimeos/aimeos-core:^2024.04.5

References

https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2024-37295[ADVISORY]
https://github.com/aimeos/aimeos-core[PACKAGE]