Arbitrary File Inclusion Vulnerability in Carbon Package
Summary
CVE-2025-22145: Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale. Affects nesbot/carbon across 2 version ranges.
< 2.72.6
>= 3.0.0, < 3.8.4
Fixed in 2.72.6 or 3.8.4, depending on the release line you run. How to fix ↓
Also tracked for
- php-nesbot-carbon · Debian:11
The same CVE-2025-22145 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Carbon is a widely-used PHP library for date and time manipulation. It provides an intuitive API for handling dates, times, and time zones, making it a popular choice among developers. However, it has a vulnerability that allows arbitrary file inclusion when unsanitized user input is passed to the Carbon::setLocale method, potentially leading to severe security risks.
Vulnerability Detail
The vulnerability arises from the Carbon::setLocale method, which can be exploited when an application passes unsanitized user input. If the application allows users to upload files with a .php extension in a directory that can be included or required, it opens the door for arbitrary code execution on the server. This can lead to unauthorized access, data breaches, and complete server compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.72.62.72.6composer require nesbot/carbon:2.72.6 -
>= 3.0.0, < 3.8.43.8.4composer require nesbot/carbon:3.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
-
0: Validate input before calling setLocale() by removing or forbidding characters such as '/' and ''.
-
1: Only call setLocale() with a locale from a predefined whitelist of supported locales.
-
2: Rename uploaded files to prevent them from having a .php extension, even if not directly affected by this issue.
-
3: Use a storage system that is not local to the application, such as a remote service or a local service running under a different user.
Conclusion
The Carbon package has a vulnerability that can lead to arbitrary file inclusion if unsanitized user input is passed to the setLocale method. It is crucial to update to the patched versions and implement the recommended workarounds to secure your application against potential exploits.
See every vulnerability recorded for nesbot/carbon →
FAQ
Carbon is a PHP library that simplifies date and time manipulation, providing an easy-to-use API for developers.
If your application allows unsanitized user input to be passed to Carbon::setLocale, it may lead to arbitrary file inclusion and execution of malicious code.
The patched versions of Carbon are 3.8.4 and 2.72.6. Updating to these versions will resolve the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Implement the suggested workarounds to mitigate the risk until you can update the package.
