Description
image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | spatie/image-optimizer | < 1.7.3 | 1.7.3 | GHSA-6pjm-hmvf-h4rr |