{"id":"GHSA-3fvf-2gp4-89wq","aliases":[],"title":"Possibility for Denial of Service by overwriting PHP files with language exports","description":"### Impact\nLaravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.\n\n### Patches\nVersion 0.6.2 fixes this issue.\n\n### Workarounds\nOnly allow trusted admins to publish/edit translations.\n\n### References\nhttps://github.com/barryvdh/laravel-translation-manager/pull/417\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/barryvdh/laravel-translation-manager\n* Email me (see Github profile)\n\n### Credits\nFound and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)","severity":"medium","score":null,"published":"2022-03-18T23:17:15.000Z","modified":"2024-12-05T05:24:22.227Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"barryvdh/laravel-translation-manager","ranges":[{"events":[{"introduced":"0"},{"fixed":"0.6.2"}],"type":"ECOSYSTEM"}],"versions":["v0.1.0","v0.1.1","v0.1.2","v0.1.3","v0.1.4","v0.2.0","v0.2.1","v0.2.2","v0.2.3","v0.2.4","v0.2.5","v0.2.6","v0.2.7","v0.2.8","v0.2.9","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.5.0","v0.5.1","v0.5.10","v0.5.2","v0.5.3","v0.5.4","v0.5.5","v0.5.6","v0.5.7","v0.5.8","v0.5.9","v0.6.0","v0.6.1"],"fixed":["0.6.2"]}],"references":["https://github.com/barryvdh/laravel-translation-manager/security/advisories/GHSA-3fvf-2gp4-89wq","https://github.com/barryvdh/laravel-translation-manager"],"sources":[{"name":"OSV","id":"GHSA-3fvf-2gp4-89wq","modified":"2024-12-05T05:24:22.227992Z","url":"https://osv.dev/vulnerability/GHSA-3fvf-2gp4-89wq"}],"assessments":[]}