Skip to content
OpenAdvisories
High USN-5983-1 1 CVE

php-nette vulnerability

Published Mar 29, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Cyku Hong discovered that Nette was not properly handling and validating
data used for code generation. A remote attacker could possibly use this
issue to execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS php-nette 2.4-20160731-1ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS php-nette 2.3.8-1ubuntu1+esm1

Vulnerabilities 1

  • High 8.7
    CVE-2020-15227 Public exploit Scanner template EPSS 34%

    Remote Code Execution vulnerability

    Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

    nette application php-nette nette/application Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2020-15227