GHSA-qhjc-hg94-245v
eZ Platform Prevent accepting app.php in URL in Platform.sh
GHSA-qhjc-hg94-245v is a vulnerability with no CVSS score yet in ezsystems/ezplatform, published May 15, 2024. No source lists public exploit code. Fixed in ezsystems/ezplatform 2.5.4.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.5.4ezsystems/ezplatform +5 more
Description
The recommended rewrite rules in eZ Platform prevent users from including the front-controller script (normally "app.php") in URLs. This prevents certain vulnerabilities related to caching. However, this is not possible when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service), nor can it be done within the .platform.app.yaml configuration file. Therefore we need to reject such requests in the application itself. This advisory adds the prevention within the front controller script itself.
If you use eZ Platform Cloud / Platform.sh we recommend that you install this security update as soon as possible. It is distributed via Composer as ezsystems/ezplatform 1.7.9.1, and 1.13.5.1, and 2.5.4. This is the commit: https://github.com/ezsystems/ezplatform/commit/34ce86722b36a172e587068fe64a84faa7320cc2
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ezsystems/ezplatformPackagist | 2.5.0 up to 2.5.4 | 2.5.4 |
ezsystems/ezplatformPackagist | 1.13.0 up to 1.13.5.1 | 1.13.5.1 |
ezsystems/ezplatformPackagist | 1.7.0 up to 1.7.9.1 | 1.7.9.1 |
ezsystems/ezplatformPackagist | 2.5.0 up to 2.5.4, plus listed versions v2.5.0v2.5.1v2.5.2v2.5.3 | 2.5.4 |
ezsystems/ezplatformPackagist | 1.13.0 up to 1.13.5.1, plus listed versions v1.13.0v1.13.1v1.13.1-rc1v1.13.1.1v1.13.2 Show 11 moreShow lessv1.13.2-rc1v1.13.3v1.13.3-rc1v1.13.4v1.13.4-beta1v1.13.4-rc1v1.13.4-rc2v1.13.4.1v1.13.5v1.13.5-rc1v1.13.5-rc2 | 1.13.5.1 |
ezsystems/ezplatformPackagist | 1.7.0 up to 1.7.9.1, plus listed versions v1.7.0v1.7.1-rc1v1.7.2v1.7.2-rc1v1.7.2-rc2 Show 19 moreShow lessv1.7.3v1.7.3-rc1v1.7.3-rc2v1.7.4v1.7.4-rc1v1.7.5v1.7.5-rc1v1.7.5-rc2v1.7.6v1.7.6-rc1v1.7.7v1.7.7-rc1v1.7.7-rc2v1.7.8v1.7.8-rc1v1.7.8-rc2v1.7.8.1v1.7.9v1.7.9-rc1 | 1.7.9.1 |
What each source reports
GitHub AdvisoriesNo score
eZ Platform Prevent accepting app.php in URL in Platform.sh
The recommended rewrite rules in eZ Platform prevent users from including the front-controller script (normally "app.php") in URLs. This prevents certain vulnerabilities related to caching. However, this is not possible when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service), nor can it be done within the .platform.app.yaml configuration file. Therefore we need to reject such requests in the application itself. This advisory adds the prevention within the front controller script itself.
If you use eZ Platform Cloud / Platform.sh we recommend that you install this security update as soon as possible. It is distributed via Composer as ezsystems/ezplatform 1.7.9.1, and 1.13.5.1, and 2.5.4. This is the commit: https://github.com/ezsystems/ezplatform/commit/34ce86722b36a172e587068fe64a84faa7320cc2
- Record
GHSA-qhjc-hg94-245v- Updated
- 2026-11-02
OSVNo score
eZ Platform Prevent accepting app.php in URL in Platform.sh
The recommended rewrite rules in eZ Platform prevent users from including the front-controller script (normally "app.php") in URLs. This prevents certain vulnerabilities related to caching. However, this is not possible when using eZ Platform Cloud (i.e. running eZ Platform on the Platform.sh cloud service), nor can it be done within the .platform.app.yaml configuration file. Therefore we need to reject such requests in the application itself. This advisory adds the prevention within the front controller script itself.
If you use eZ Platform Cloud / Platform.sh we recommend that you install this security update as soon as possible. It is distributed via Composer as ezsystems/ezplatform 1.7.9.1, and 1.13.5.1, and 2.5.4. This is the commit: https://github.com/ezsystems/ezplatform/commit/34ce86722b36a172e587068fe64a84faa7320cc2
- Record
GHSA-qhjc-hg94-245v- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/ezsystems/ezplatform/commit/34ce86722b36a172e587068fe64a84faa7320cc2
share.ez.no/community-project/security-advisories/ezsa-2019-007-prevent-accepting-app.php-in-url-in-platform.sh