An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar://
wrapper.
{ "github_reviewed_at": "2022-10-06T19:53:20Z", "severity": "CRITICAL", "cwe_ids": [ "CWE-502" ], "github_reviewed": true, "nvd_published_at": null }