CVE-2024-47049

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-22 CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/czim/file-handling/blob/2.3.0/SECURITY.mdThird Party Advisory

Timeline

Published: Sep 17, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-47055.4The Testimonials Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's testimonials shortcode in all ver CVE-2024-470506.1Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.CVE-2024-470519.9This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploi CVE-2024-470537.7This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthori CVE-2024-470554.3SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows an CVE-2024-470565.1SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a CVE-2024-470575.3SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability co CVE-2024-470584.8With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive CVE-2024-470594.3When logging in with the correct username and incorrect weak password, the user receives the notification, that their password is too weak. CVE-2024-47066.4The WordPress + Microsoft Office 365 / Azure AD | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'CVE-2024-470606.5Zitadel is an open source identity management platform. In Zitadel, even after an organization is deactivated, associated projects, respecti CVE-2024-470618.3Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text editors. One longsta