{"id":"GHSA-44m4-9cjp-j587","aliases":[],"status":"published","title":"IBX-1392: Image filenames sanitization","description":"ezsystems/ezpublish-kernel versions 7.5.* before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-01-21T23:24:14Z","modified":"2024-12-04T05:42:04Z","fixes":[{"ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","fixed_in":["7.5.26"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.0"},{"fixed":"7.5.26"}]}]},{"source":"osv","ecosystem":"Packagist","package":"ezsystems/ezpublish-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.5.0"},{"fixed":"7.5.26"}]}],"versions":["v7.5.0","v7.5.1","v7.5.10","v7.5.11","v7.5.12","v7.5.13","v7.5.14","v7.5.15","v7.5.15.1","v7.5.15.2","v7.5.16","v7.5.17","v7.5.18","v7.5.19","v7.5.2","v7.5.20","v7.5.21","v7.5.22","v7.5.23","v7.5.24","v7.5.25","v7.5.3","v7.5.4","v7.5.5","v7.5.6","v7.5.6-rc1","v7.5.6.2","v7.5.7","v7.5.7-rc1","v7.5.7.1","v7.5.8","v7.5.9","v7.5.9.1"]}],"references":[{"url":"https://github.com/ezsystems/ezpublish-kernel/security/advisories/GHSA-44m4-9cjp-j587","tags":["web"]},{"url":"https://developers.ibexa.co/security-advisories/ibexa-sa-2022-001-image-filenames-sanitization","tags":["web"]},{"url":"https://github.com/ezsystems/ezpublish-kernel/releases/tag/v7.5.26","tags":["web"]},{"url":"https://github.com/advisories/GHSA-44m4-9cjp-j587"},{"url":"https://github.com/ezsystems/ezpublish-kernel","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-44m4-9cjp-j587","title":"IBX-1392: Image filenames sanitization","description":"ezsystems/ezpublish-kernel versions 7.5.* before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files.","status":"published","published":"2022-01-21T23:24:14Z","modified":"2023-01-11T05:03:58Z","updated_at":"2026-11-02T14:36:12.361159Z"}],"osv":[{"id":"GHSA-44m4-9cjp-j587","title":"IBX-1392: Image filenames sanitization","description":"ezsystems/ezpublish-kernel versions 7.5.* before 7.5.26 are vulnerable to certain injection attacks and unauthorized access to some image files.","status":"published","published":"2022-01-21T23:24:14Z","modified":"2024-12-04T05:42:04.230003Z","updated_at":"2026-11-02T15:46:36.434231Z"}]}}