{"id":"GHSA-8gv3-3j7f-wg94","aliases":["CVE-2020-15227"],"title":"Potential Remote Code Execution vulnerability","description":"Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. \n\nReported by Cyku Hong from DEVCORE (https://devco.re)\n\n### Impact\nCode injection, possible remote code execution.\n\n### Patches\nFixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13","severity":"high","score":8.7,"published":"2020-10-02T16:22:19.000Z","modified":"2026-07-08T06:29:28.739Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"nette/application","ranges":[{"events":[{"introduced":"2.2.0"},{"fixed":"2.2.10"}],"type":"ECOSYSTEM"}],"versions":["v2.2.0","v2.2.1","v2.2.2","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.2.8","v2.2.9"],"fixed":["2.2.10"]},{"ecosystem":"Packagist","name":"nette/application","ranges":[{"events":[{"introduced":"2.3.0"},{"fixed":"2.3.14"}],"type":"ECOSYSTEM"}],"versions":["v2.3.0","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9"],"fixed":["2.3.14"]},{"ecosystem":"Packagist","name":"nette/application","ranges":[{"events":[{"introduced":"2.4.0"},{"fixed":"2.4.16"}],"type":"ECOSYSTEM"}],"versions":["v2.4.0","v2.4.1","v2.4.10","v2.4.11","v2.4.12","v2.4.13","v2.4.14","v2.4.15","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9"],"fixed":["2.4.16"]},{"ecosystem":"Packagist","name":"nette/application","ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.0.6"}],"type":"ECOSYSTEM"}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.2.1","v3.0.3","v3.0.4","v3.0.5"],"fixed":["3.0.6"]},{"ecosystem":"Packagist","name":"nette/application","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.19"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["2.0.19"]},{"ecosystem":"Packagist","name":"nette/application","ranges":[{"events":[{"introduced":"2.1.0"},{"fixed":"2.1.13"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["2.1.13"]}],"references":["https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94","https://nvd.nist.gov/vuln/detail/CVE-2020-15227","https://blog.nette.org/en/cve-2020-15227-potential-remote-code-execution-vulnerability","https://github.com/FriendsOfPHP/security-advisories/blob/master/nette/application/CVE-2020-15227.yaml","https://github.com/nette/application","https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html","https://packagist.org/packages/nette/application","https://packagist.org/packages/nette/nette"],"sources":[{"name":"OSV","id":"GHSA-8gv3-3j7f-wg94","modified":"2026-07-08T06:29:28.739222447Z","url":"https://osv.dev/vulnerability/GHSA-8gv3-3j7f-wg94"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","score":8.7}]}