An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar://
wrapper.
{ "github_reviewed_at": "2022-10-06T19:53:20Z", "nvd_published_at": null, "github_reviewed": true, "cwe_ids": [ "CWE-502" ], "severity": "CRITICAL" }