{"id":"GHSA-6rgh-r6j3-3223","aliases":["CVE-2024-47049"],"title":"czim/file-handling vulnerable to SSRF and directory traversal","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.","severity":"high","score":8.2,"published":"2024-09-17T15:31:23.000Z","modified":"2025-03-19T15:44:55.450Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"czim/file-handling","sources":[{"name":"OSV · GHSA-6rgh-r6j3-3223","url":"https://osv.dev/vulnerability/GHSA-6rgh-r6j3-3223"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.5.0"}],"type":"ECOSYSTEM"}],"versions":["0.9.0","0.9.1","0.9.10","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.4.0"],"fixed":["1.5.0"]},{"ecosystem":"Packagist","name":"czim/file-handling","sources":[{"name":"OSV · GHSA-6rgh-r6j3-3223","url":"https://osv.dev/vulnerability/GHSA-6rgh-r6j3-3223"}],"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.3.0"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.2.1"],"fixed":["2.3.0"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-47049","https://github.com/czim/file-handling/commit/95dfda850536bf35e684619598b9d02f4c97680d","https://github.com/czim/file-handling/commit/dcf879896efe3457f51af9c8eab9f70dfc709a99","https://github.com/czim/file-handling","https://github.com/czim/file-handling/blob/2.3.0/SECURITY.md"],"sources":[{"name":"OSV","id":"GHSA-6rgh-r6j3-3223","modified":"2025-03-19T15:44:55.450644Z","url":"https://osv.dev/vulnerability/GHSA-6rgh-r6j3-3223"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N","score":6.9}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:35:31.531Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}