Ibexa Kernel: Unwanted Files Can Be Saved to Drafts
Summary
GHSA-mwvh-p3hx-x4gg: Ibexa Kernel's files with blacklisted extensions can be still saved to drafts. Affects ezsystems/ezplatform-kernel versions >= 1.3.0, < 1.3.35. Fixed in 1.3.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ibexa Kernel is a package that provides the core functionality for the Ibexa Content Management System (CMS). It allows users to create and manage content, including files. The package includes file validation to reject certain file types. However, a vulnerability in the file validation process allows blacklisted files to be saved to drafts, even though they cannot be published. This means that unwanted files can still be present in storage, posing a potential security risk.
Vulnerability Detail
The vulnerability in Ibexa Kernel allows files with blacklisted extensions to be saved to drafts. While these files cannot be published, they remain in storage, potentially accessible to attackers. The issue arises from a failure in the file validation process, which should prevent the saving of blacklisted files. An attacker would need existing access to create content with a file field type to exploit this vulnerability. The impact of this vulnerability is moderate.
How To Fix
Minimum fixed version
1.3.35
This is the first release that contains the fix.
composer require ezsystems/ezplatform-kernel:1.3.35Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users must update to the patched versions to address the issue.
Conclusion
The vulnerability in Ibexa Kernel allows blacklisted files to be saved to drafts, posing a potential security risk. Users should update to the patched versions (1.3.35 or later) to prevent the saving of unwanted files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ezsystems/ezplatform-kernel →
FAQ
Ibexa Kernel is a package that provides the core functionality for the Ibexa Content Management System (CMS). It allows users to create and manage content, including files.
The impact of this vulnerability is moderate. While the blacklisted files cannot be published, they remain in storage and could potentially be accessed by attackers.
To fix this vulnerability, users should update to the patched versions of Ibexa Kernel (version 1.3.35 or later).
No, there is no known workaround for this vulnerability. Updating to the patched versions is the only solution.
Yes, an attacker would need existing access to create content with a file field type to exploit this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for ezsystems/ezplatform-kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
