GHSA-2r53-9295-3m86: Code Injection
First published: Tue Nov 14 2023(Updated: )
### Impact Similar to [another advisory](https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc), certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules. This affects front-end forms using the "Forms" feature, and asset upload fields in the control panel. ### Patches It has been patched in 3.4.14 and 4.34.0.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/statamic/cms | <3.4.14 | 3.4.14 |
| composer/statamic/cms | >=4.0.0<4.34.0 | 4.34.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/statamic/cms/security/advisories/GHSA-2r53-9295-3m86
- https://github.com/statamic/cms/pull/8991
- https://github.com/statamic/cms/pull/8992
- https://github.com/statamic/cms/commit/4c6fe041e2203a8033e5949ce4a5d9d6c0ad2411
- https://github.com/statamic/cms/commit/da28afde818d605179fbb63b96eabafabad876b6
- https://github.com/statamic/cms/releases/tag/v3.4.14
- https://github.com/statamic/cms/releases/tag/v4.34.0
- https://nvd.nist.gov/vuln/detail/CVE-2023-48217
- https://github.com/advisories/GHSA-2r53-9295-3m86 (Advisory)
Frequently Asked Questions
What is the impact of GHSA-2r53-9295-3m86?
Certain additional PHP files crafted to look like images may be uploaded regardless of mime type validation rules, affecting front-end forms using the "Forms" feature and asset uploads.
How does GHSA-2r53-9295-3m86 affect the Statamic CMS?
GHSA-2r53-9295-3m86 affects the Statamic CMS by allowing the upload of PHP files disguised as images, bypassing mime type validation rules.
What is the severity of GHSA-2r53-9295-3m86?
The severity of GHSA-2r53-9295-3m86 is high, with a severity value of 8.8.
What is the Common Weakness Enumeration (CWE) for GHSA-2r53-9295-3m86?
The CWE for GHSA-2r53-9295-3m86 is CWE-94.
How can I fix GHSA-2r53-9295-3m86?
To fix GHSA-2r53-9295-3m86, update the Statamic CMS to version 3.4.14 (for 3.x.x users) or version 4.34.0 (for 4.x.x users).
- collector/github-advisory-latest
- alias/GHSA-2r53-9295-3m86
- alias/CVE-2023-48217
- collector/github-advisory
- agent/weakness
- agent/references
- agent/severity
- agent/type
- agent/description
- agent/tags
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- package-manager/composer