CVE-2024-47049

8.2 highEPSS 0.6%

High (8.2) in czim file-handling. EPSS 0.6% chance of exploitation in the next 30 days.

The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

Severity

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWEs: CWE-22, CWE-918
Published: 2024-09-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

czim:file-handling

References

https://github.com/czim/file-handling/blob/2.3.0/SECURITY.md

Check your stack JSON