{"id":"GHSA-g8v9-c8m3-942v","aliases":["CVE-2024-48514"],"title":"Remote code execution in php-heic-to-jpg","description":"php-heic-to-jpg < 1.0.5 is vulnerable to remote code execution. An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg below 1.0.5.","severity":"critical","score":9.8,"published":"2024-10-24T18:30:44.000Z","modified":"2024-12-19T20:27:18.049Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"maestroerror/php-heic-to-jpg","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.0.5"}],"type":"ECOSYSTEM"}],"versions":["v0.1","v0.2","v0.3","v0.3.1","v0.3.2","v0.4.0","v1.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4"],"fixed":["1.0.5"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2024-48514","https://github.com/MaestroError/php-heic-to-jpg/pull/34","https://advisories.gitlab.com/pkg/composer/maestroerror/php-heic-to-jpg/CVE-2024-48514","https://github.com/MaestroError/php-heic-to-jpg","https://github.com/advisories/GHSA-g8v9-c8m3-942v","https://github.com/marcoris/CVEs/tree/master/CVE-2024-48514"],"sources":[{"name":"OSV","id":"GHSA-g8v9-c8m3-942v","modified":"2024-12-19T20:27:18.049146Z","url":"https://osv.dev/vulnerability/GHSA-g8v9-c8m3-942v"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","score":8.1}]}