GHSA-m3px-vjxr-fx4m
Suggest an improvement- Source
- https://github.com/advisories/GHSA-m3px-vjxr-fx4m
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-m3px-vjxr-fx4m/GHSA-m3px-vjxr-fx4m.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-m3px-vjxr-fx4m
- Aliases
- Published
- 2024-08-12T18:36:10Z
- Modified
- 2024-08-12T18:57:06.007322Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint
- Details
-
Impact
The export download route
/filament-excel/{path}allowed downloading any file without login when the webserver allows../in the URL.Patches
Patched with Version v2.3.3
Credits
Thanks to Kevin Pohl for reporting this.
- References
Affected packages
Packagist / pxlrbt/filament-excel
Package
- Name
- pxlrbt/filament-excel
- Purl
- pkg:composer/pxlrbt/filament-excel
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.3.3
Affected versions
0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
v1.*
v1.0.0-beta
v1.0.0-beta2
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v2.*
v2.0.0-alpha
v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.1.7
v2.1.8
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.3.1
v2.3.2