GHSA-2gq2-m628-33xphigh
gregwar/rst Local File Inclusion Vulnerability
No CVE assignedCheck your stack
The advisory, in context
A Local File Inclusion (LFI) vulnerability has been discovered in the gregwar/rst library, potentially exposing sensitive files on the server to unauthorized users. The issue arises from inadequate input validation, allowing an attacker to manipulate file paths and include arbitrary files.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
gregwar/rst Packagist
Ecosystem versions
Earlier releases before 1.0.3
Fixed in 1.0.3
3 explicitly affected versions
v1.0.0, v1.0.1, v1.0.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v1.0.0",
"v1.0.1",
"v1.0.2"
]
}