CVE-2024-47049

czim/file-handling vulnerable to SSRF and directory traversal

8.2 HighFix available

The czim/file-handling package before 1.5.0 and 2.x before 2.3.0 (used with PHP Composer) does not properly validate URLs within makeFromUrl and makeFromAny, leading to SSRF, and to directory traversal for the reading of local files.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.64%Up 0.6 points since Sep 18, 2024

What each source reports

NVD Score used8.2

Record: CVE-2024-47049
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-22, CWE-918
Updated: 2026-11-02

CVE List8.2

Record: CVE-2024-47049
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-22, CWE-918
Updated: 2026-11-02

EUVDEUVD-2024-27388.2

Record: EUVD-2024-2738
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-6rgh-r6j3-32236.9

czim/file-handling vulnerable to SSRF and directory traversal

Record: GHSA-6rgh-r6j3-3223
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-22, CWE-918
Updated: 2026-11-02

OSV8.2

Record: CVE-2024-47049
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-02

OSVGHSA-6rgh-r6j3-32236.9

czim/file-handling vulnerable to SSRF and directory traversal

Record: GHSA-6rgh-r6j3-3223
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-22, CWE-918
Updated: 2026-11-02

Affected products

czim file-handling

Affected packages

Affected packages
Package	Affected	Fixed
`czim/file-handling` Packagist	before 1.5.0	1.5.0
`czim/file-handling` Packagist	2.0.0 up to 2.3.0	2.3.0
`czim/file-handling` Packagist	before 1.5.0, plus listed versions 0.9.00.9.10.9.100.9.20.9.3 Show 23 moreShow less 0.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.21.0.31.0.41.1.01.1.11.1.21.1.31.1.41.1.51.2.01.2.11.3.01.3.11.3.21.4.0	1.5.0
`czim/file-handling` Packagist	2.0.0 up to 2.3.0, plus listed versions 2.0.12.0.22.0.32.1.02.1.1 Show 5 moreShow less 2.1.22.1.32.1.42.1.52.2.1	2.3.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-47049 is a high vulnerability (CVSS 8.2) in Czim File-handling, published September 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in czim/file-handling 1.5.0.