High · 8.8 CVE-2020-12479 EUVD-2022-2813GHSA-6jf9-8m34-96w5

TeamPass PHP arbitrary file include vulnerability

Published Apr 29, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: nilsteampassnet/teampass Ecosystem: Packagist

Description

TeamPass 2.1.27.36 allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with sources/users.queries.php newValue directory traversal.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	nilsteampassnet/teampass	<= 2.1.27.36	—	GHSA-6jf9-8m34-96w5

References

https://github.com/nilsteampassnet/TeamPass/issues/2762