Description
Sulu is an open-source PHP content management system based on the Symfony framework. In affected versions an attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution. The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0. For users unable to upgrade overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sulu | sulu | < 1.6.44, >= 2.0.0, < 2.2.18, >= 2.3.0, < 2.3.8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | sulu/sulu | < 1.6.44 | 1.6.44 | GHSA-vx6j-pjrh-vgjh |
| Packagist | sulu/sulu | >= 2.0.0, < 2.2.18 | 2.2.18 | GHSA-vx6j-pjrh-vgjh |
| Packagist | sulu/sulu | >= 2.3.0, < 2.3.8 | 2.3.8 | GHSA-vx6j-pjrh-vgjh |
| Packagist | sulu/sulu | >= 2.4.0-RC1, < 2.4.0 | 2.4.0 | GHSA-vx6j-pjrh-vgjh |