{"id":"GHSA-mvf6-3f2g-xfxf","aliases":[],"status":"published","title":"endroid/qr-code-bundle File Disclosure via logo_path query parameter","description":"Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2024-05-15T21:05:13Z","modified":"2024-11-29T05:37:08Z","fixes":[{"ecosystem":"Packagist","package":"endroid/qr-code-bundle","fixed_in":["3.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"endroid/qr-code-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"endroid/qr-code-bundle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.4.0","3.4.1"]}],"references":[{"url":"https://github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/endroid/qr-code-bundle/2019-12-22.yaml","tags":["web"]},{"url":"https://github.com/endroid/qr-code-bundle/releases/tag/3.4.2","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mvf6-3f2g-xfxf"},{"url":"https://github.com/endroid/qr-code-bundle","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-mvf6-3f2g-xfxf","title":"endroid/qr-code-bundle File Disclosure via logo_path query parameter","description":"Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.","status":"published","published":"2024-05-15T21:05:13Z","modified":"2024-05-15T21:05:19Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:49.48194Z"}],"osv":[{"id":"GHSA-mvf6-3f2g-xfxf","title":"endroid/qr-code-bundle File Disclosure via logo_path query parameter","description":"Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.","status":"published","published":"2024-05-15T21:05:13Z","modified":"2024-11-29T05:37:08.887462Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}