{"id":"GHSA-3fvf-2gp4-89wq","aliases":[],"status":"published","title":"Possibility for Denial of Service by overwriting PHP files with language exports","description":"### Impact\nLaravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.\n\n### Patches\nVersion 0.6.2 fixes this issue.\n\n### Workarounds\nOnly allow trusted admins to publish/edit translations.\n\n### References\nhttps://github.com/barryvdh/laravel-translation-manager/pull/417\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/barryvdh/laravel-translation-manager\n* Email me (see Github profile)\n\n### Credits\nFound and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-03-18T23:17:15Z","modified":"2024-12-05T05:24:22Z","fixes":[{"ecosystem":"Packagist","package":"barryvdh/laravel-translation-manager","fixed_in":["0.6.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"barryvdh/laravel-translation-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"barryvdh/laravel-translation-manager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2"}]}],"versions":["v0.1.0","v0.1.1","v0.1.2","v0.1.3","v0.1.4","v0.2.0","v0.2.1","v0.2.2","v0.2.3","v0.2.4","v0.2.5","v0.2.6","v0.2.7","v0.2.8","v0.2.9","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.5.0","v0.5.1","v0.5.10","v0.5.2","v0.5.3","v0.5.4","v0.5.5","v0.5.6","v0.5.7","v0.5.8","v0.5.9","v0.6.0","v0.6.1"]}],"references":[{"url":"https://github.com/barryvdh/laravel-translation-manager/security/advisories/GHSA-3fvf-2gp4-89wq","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3fvf-2gp4-89wq"},{"url":"https://github.com/barryvdh/laravel-translation-manager","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-3fvf-2gp4-89wq","title":"Possibility for Denial of Service by overwriting PHP files with language exports","description":"### Impact\nLaravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.\n\n### Patches\nVersion 0.6.2 fixes this issue.\n\n### Workarounds\nOnly allow trusted admins to publish/edit translations.\n\n### References\nhttps://github.com/barryvdh/laravel-translation-manager/pull/417\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/barryvdh/laravel-translation-manager\n* Email me (see Github profile)\n\n### Credits\nFound and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)","status":"published","published":"2022-03-18T23:17:15Z","modified":"2023-01-11T05:06:04Z","updated_at":"2026-11-02T14:36:12.361159Z"}],"osv":[{"id":"GHSA-3fvf-2gp4-89wq","title":"Possibility for Denial of Service by overwriting PHP files with language exports","description":"### Impact\nLaravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.\n\n### Patches\nVersion 0.6.2 fixes this issue.\n\n### Workarounds\nOnly allow trusted admins to publish/edit translations.\n\n### References\nhttps://github.com/barryvdh/laravel-translation-manager/pull/417\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/barryvdh/laravel-translation-manager\n* Email me (see Github profile)\n\n### Credits\nFound and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)","status":"published","published":"2022-03-18T23:17:15Z","modified":"2024-12-05T05:24:22.227992Z","updated_at":"2026-11-02T15:46:35.747385Z"}]}}