{"id":"GHSA-mvf6-3f2g-xfxf","aliases":[],"title":"endroid/qr-code-bundle File Disclosure via logo_path query parameter","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.","severity":"medium","score":null,"published":"2024-05-15T21:05:13.000Z","modified":"2024-11-29T05:37:08.887Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"endroid/qr-code-bundle","sources":[{"name":"OSV · GHSA-mvf6-3f2g-xfxf","url":"https://osv.dev/vulnerability/GHSA-mvf6-3f2g-xfxf"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.4.2"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1"],"fixed":["3.4.2"]}],"sourceAffected":[],"references":["https://github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8","https://github.com/FriendsOfPHP/security-advisories/blob/master/endroid/qr-code-bundle/2019-12-22.yaml","https://github.com/endroid/qr-code-bundle","https://github.com/endroid/qr-code-bundle/releases/tag/3.4.2"],"sources":[{"name":"OSV","id":"GHSA-mvf6-3f2g-xfxf","modified":"2024-11-29T05:37:08.887462Z","url":"https://osv.dev/vulnerability/GHSA-mvf6-3f2g-xfxf"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-29T02:25:31.980Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}