{"id":"CVE-2025-22145","aliases":["CLSA-2025-1756946896","CLSA-2026-1771375695","DEBIAN-CVE-2025-22145","DLA-4068-1","EUVD-2025-0030","GHSA-j3f9-p6hm-5w6q","UBUNTU-CVE-2025-22145"],"status":"published","title":"Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale","description":"Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00753,"percentile":0.55394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-98"],"published":"2025-01-08T20:40:37Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Packagist","package":"nesbot/carbon","fixed_in":["3.8.4","2.72.6"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"nesbot/carbon","fixed_in":["1.26.6-p1+tuxcare","1.39.1-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-nesbot-carbon","fixed_in":["2.65.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-nesbot-carbon","fixed_in":["2.72.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-nesbot-carbon","fixed_in":["2.72.6-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"php-nesbot-carbon","fixed_in":["2.32.2-1+deb11u1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"nesbot/carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.8.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"nesbot/carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.6"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"nesbot/carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.6"},{"fixed":"1.26.6-p1+tuxcare"}]}],"versions":["1.26.6"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"nesbot/carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.39.1"},{"fixed":"1.39.1-p1+tuxcare"}]}],"versions":["1.39.1"]},{"source":"osv","ecosystem":"Debian:12","package":"php-nesbot-carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.65.0-1+deb12u1"}]}],"versions":["2.65.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"php-nesbot-carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-nesbot-carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.6-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"php-nesbot-carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.2-1+deb11u1"}]}],"versions":["2.32.2-1"]},{"source":"osv","ecosystem":"Packagist","package":"nesbot/carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.8.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.8.1","3.8.2","3.8.3"]},{"source":"osv","ecosystem":"Packagist","package":"nesbot/carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.6"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.10.0","1.11.0","1.12.0","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.21.0","1.22.0","1.22.1","1.23.0","1.24.0","1.24.1","1.24.2","1.25.0","1.25.1","1.25.3","1.26.0","1.26.1","1.26.2","1.26.3","1.26.4","1.26.5","1.26.6","1.27.0","1.28.0","1.29.0","1.29.1","1.29.2","1.3.0","1.30.0","1.31.0","1.31.1","1.32.0","1.33.0","1.34.0","1.34.1","1.34.2","1.34.3","1.34.4","1.35.0","1.35.1","1.36.0","1.36.1","1.36.2","1.37.0","1.37.1","1.38.0","1.38.1","1.38.2","1.38.3","1.38.4","1.39.0","1.39.1","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0","2.0.0","2.0.0-beta.1","2.0.0-beta.2","2.0.0-beta.3","2.0.0-beta.4","2.0.0-beta.5","2.0.0-beta.6","2.0.1","2.1.0","2.1.1","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.14.0","2.14.1","2.14.2","2.15.0","2.16.0","2.16.1","2.16.2","2.16.3","2.17.0","2.17.1","2.18.0","2.19.0","2.19.1","2.19.2","2.2.0","2.2.1","2.20.0","2.21.0","2.21.1","2.21.2","2.21.3","2.22.0","2.22.0-beta.1","2.22.0-beta.2","2.22.0-beta.3","2.22.1","2.22.2","2.22.3","2.23.0","2.23.0-beta.1","2.23.0-beta.2","2.23.0-beta.3","2.23.0-beta.4","2.23.1","2.24.0","2.24.0-beta.1","2.24.0-beta.2","2.24.0-beta.3","2.24.0-beta.4","2.25.0","2.25.0-beta.1","2.25.0-beta.2","2.25.0-beta.3","2.25.1","2.25.2","2.25.3","2.26.0","2.27.0","2.28.0","2.28.0-beta.1","2.29.0","2.29.1","2.3.0","2.3.1","2.30.0","2.31.0","2.32.0","2.32.1","2.32.2","2.33.0","2.34.0","2.34.1","2.34.2","2.35.0","2.36.0","2.36.1","2.37.0","2.38.0","2.39.0","2.39.1","2.39.2","2.4.0","2.4.1","2.40.0","2.40.1","2.41.0","2.41.1","2.41.2","2.41.3","2.41.4","2.41.5","2.42.0","2.43.0","2.44.0","2.45.0","2.45.1","2.46.0","2.47.0","2.47.1","2.48.0","2.48.1","2.49.0","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.50.0","2.51.0","2.51.1","2.52.0","2.53.0","2.53.1","2.54.0","2.55.0","2.55.1","2.55.2","2.56.0","2.57.0","2.58.0","2.59.0","2.59.1","2.6.0","2.6.1","2.60.0","2.61.0","2.62.0","2.62.1","2.63.0","2.64.0","2.64.1","2.65.0","2.66.0","2.67.0","2.68.0","2.68.1","2.69.0","2.7.0","2.70.0","2.71.0","2.72.0","2.72.1","2.72.2","2.72.3","2.72.4","2.72.5","2.8.0","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"php-nesbot-carbon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.27.0-2"]}],"products":[{"vendor":"carbonphp","product":"carbon"}],"references":[{"url":"https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00032.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22145","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j3f9-p6hm-5w6q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22145.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-22145","tags":["advisory"]},{"url":"https://github.com/CarbonPHP/carbon","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-22145","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22145","tags":["report"]},{"url":"https://github.com/briannesbitt/Carbon/commit/1e9d50601e7035a4c61441a208cb5bed73e108c5","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-22145","title":"Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale","description":"Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.","status":"published","published":"2025-01-08T20:40:37.545Z","modified":"2025-02-25T13:07:45.559Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:32:29.286772Z"}],"euvd":[{"id":"EUVD-2025-0030","description":"Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.","status":"published","published":"2025-01-08T20:40:37Z","modified":"2025-02-25T13:07:45Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:53:25.075327Z"}],"ghsa":[{"id":"GHSA-j3f9-p6hm-5w6q","title":"Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale","description":"### Impact\nApplication passing unsanitized user input to `Carbon::setLocale` are at risk of arbitrary file include, if the application allows users to upload files with `.php` extension in an folder that allows `include` or `require` to read it, then they are at risk of arbitrary code ran on their servers.\n\n### Patches\n- [3.8.4](https://github.com/briannesbitt/Carbon/releases/tag/3.8.4)\n- [2.72.6](https://github.com/briannesbitt/Carbon/releases/tag/2.72.6)\n\n### Workarounds\nAny of the below actions can be taken to prevent the issue:\n- Validate input before calling `setLocale()`, for instance by forbidding or removing `/` and `\\`\n- Call `setLocale()` only with a locale from a whitelist of supported locales\n- When uploading files, rename them so they cannot have a `.php` extension (this is recommended even if you're not affected by this issue)\n- Prefer storage system that are not local to the application (remote service, or local service ran by another user so the uploaded files actually live outside of the application basedir)\n\n### References\nhttps://en.wikipedia.org/wiki/File_inclusion_vulnerability\n\n### Credits\nThanks to **Szczepan Hołyszewski** who reported the issue and to Tidelift to coordinate the resolution","status":"published","published":"2025-01-08T21:03:28Z","modified":"2025-02-25T18:39:51Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:38:33.163519Z"}],"nvd":[{"id":"CVE-2025-22145","description":"Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.","status":"published","published":"2025-01-08T21:15:13.48Z","modified":"2026-06-17T08:45:20.153Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:10:48.373347Z"}],"osv":[{"id":"CVE-2025-22145","title":"Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale","description":"Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.","status":"published","published":"2025-01-08T20:40:37.545Z","modified":"2026-10-28T02:31:09.752863018Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DEBIAN-CVE-2025-22145","description":"Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.","status":"published","published":"2025-01-08T21:15:13.48Z","modified":"2026-09-01T20:05:44.881435427Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:45.524682Z"},{"id":"GHSA-j3f9-p6hm-5w6q","title":"Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale","description":"### Impact\nApplication passing unsanitized user input to `Carbon::setLocale` are at risk of arbitrary file include, if the application allows users to upload files with `.php` extension in an folder that allows `include` or `require` to read it, then they are at risk of arbitrary code ran on their servers.\n\n### Patches\n- [3.8.4](https://github.com/briannesbitt/Carbon/releases/tag/3.8.4)\n- [2.72.6](https://github.com/briannesbitt/Carbon/releases/tag/2.72.6)\n\n### Workarounds\nAny of the below actions can be taken to prevent the issue:\n- Validate input before calling `setLocale()`, for instance by forbidding or removing `/` and `\\`\n- Call `setLocale()` only with a locale from a whitelist of supported locales\n- When uploading files, rename them so they cannot have a `.php` extension (this is recommended even if you're not affected by this issue)\n- Prefer storage system that are not local to the application (remote service, or local service ran by another user so the uploaded files actually live outside of the application basedir)\n\n### References\nhttps://en.wikipedia.org/wiki/File_inclusion_vulnerability\n\n### Credits\nThanks to **Szczepan Hołyszewski** who reported the issue and to Tidelift to coordinate the resolution","status":"published","published":"2025-01-08T21:03:28Z","modified":"2025-02-25T18:48:28.814404Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"UBUNTU-CVE-2025-22145","description":"Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.","status":"published","published":"2025-01-08T21:15:00Z","modified":"2025-10-24T05:18:01Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"CLSA-2025-1756946896","title":"TuxCare security update for nesbot/carbon (1 CVE)","description":"TuxCare rebuilt nesbot/carbon to address 1 CVE. Fixed in 1.26.6-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:47:21.164994805Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1771375695","title":"TuxCare security update for nesbot/carbon (1 CVE)","description":"TuxCare rebuilt nesbot/carbon to address 1 CVE. Fixed in 1.39.1-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:48:04.671582121Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"DLA-4068-1","title":"php-nesbot-carbon - security update","status":"published","published":"2025-02-25T00:00:00Z","modified":"2026-03-09T01:20:40.492965Z","updated_at":"2026-11-02T15:46:12.7027Z"}]}}