Description
A Local File Inclusion (LFI) vulnerability has been discovered in the gregwar/rst library, potentially exposing sensitive files on the server to unauthorized users. The issue arises from inadequate input validation, allowing an attacker to manipulate file paths and include arbitrary files.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | gregwar/rst | < 1.0.3 | 1.0.3 | GHSA-2gq2-m628-33xp |
References
- https://github.com/Gregwar/RST/pull/34 web
- https://github.com/Gregwar/RST/commit/e8d90ccbeddd91ba3abc506079661dce234f9870 web
- https://hackerone.com/reports/179034 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/gregwar/rst/2016-10-31.yaml web
- https://github.com/Gregwar/RST package