CVE-2024-47049

—

CVSS 3.1

8.2 high

EPSS

<1%p48

Published

Sep 17, 2024 (Sep 17, 2024)

Modified

Jun 17, 2026

Description

The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

Vendors: czim
Products: file-handling
Weakness: CWE-22, CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.