Description (CNA)
Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| craftcms / cms | affected >= 4.0.0-RC1, < 4.12.2; affected >= 5.0.0-RC1, < 5.4.3 |
CWE
CWE-22
References
- https://github.com/craftcms/cms/security/advisories/GHSA-f3cw-hg6r-chfv
- https://github.com/craftcms/cms/commit/123e48a696de1e2f63ab519d4730eb3b87beaa58
ADP enrichment
No English description supplied.
No references supplied.