GHSA-mvf6-3f2g-xfxf
endroid/qr-code-bundle File Disclosure via logo_path query parameter
Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.
What each source reports
GitHub AdvisoriesNo score
endroid/qr-code-bundle File Disclosure via logo_path query parameter
Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.
- Record
GHSA-mvf6-3f2g-xfxf- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
endroid/qr-code-bundle File Disclosure via logo_path query parameter
Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.
- Record
GHSA-mvf6-3f2g-xfxf- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
endroid/qr-code-bundlePackagist | before 3.4.2 | 3.4.2 |
endroid/qr-code-bundlePackagist | before 3.4.2, plus listed versions 3.0.03.0.13.0.23.1.03.1.1 Show 14 moreShow less3.1.23.1.33.1.43.2.03.2.13.2.23.2.33.3.03.3.13.3.23.3.33.3.43.4.03.4.1 | 3.4.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-mvf6-3f2g-xfxf is a vulnerability with no CVSS score yet in endroid/qr-code-bundle, published May 15, 2024. No source lists public exploit code. Fixed in endroid/qr-code-bundle 3.4.2.
References
github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8