Skip to content
OpenAdvisories
Medium DLA-4068-1 1 CVE

php-nesbot-carbon - security update

Published Feb 25, 2025 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 php-nesbot-carbon 2.32.2-1+deb11u1

Vulnerabilities 1

  • Medium 6.3
    CVE-2025-22145

    Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

    Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include …

    CarbonPHP carbon php-nesbot-carbon nesbot/carbon Debian Ubuntu Packagist