VulnerableCode Package Details - pkg:composer/saloonphp/saloon@0.9.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-96sf-jhes-2ff2 Aliases: CVE-2026-33183 GHSA-f7xc-5852-fj99	Saloon has a Fixture Name Path Traversal Vulnerability ### Impact Users with MockResponse fixtures that use path traversal. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description Fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix adds validation in the fixture layer (rejecting names with /, \, .., or null bytes, and restricting to a safe character set) and defence-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write). ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.	4.0.0 Affected by 0 other vulnerabilities.
VCID-a7cx-bfp9-r7dp Aliases: CVE-2026-33942 GHSA-rf88-776r-rcq9	Saloon has insecure deserialization in AccessTokenAuthenticator ### Impact Users of the OAuth2 utilities in Saloon, specifically the `AccessTokenAuthenticator` class. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description The Saloon PHP library used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized "gadget" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually. ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @jonpurvis for applying the fix.	4.0.0 Affected by 0 other vulnerabilities.
VCID-wnrn-gpbe-effq Aliases: CVE-2026-33182 GHSA-c83f-3xp6-hfcp	Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL ### Impact Users providing user generated input into the `resolveEndpoint` method on requests. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description When building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL (e.g. https://attacker.example.com/callback), the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix (in the next major version) is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis. ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.	4.0.0 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-96sf-jhes-2ff2
Aliases:
CVE-2026-33183
GHSA-f7xc-5852-fj99

Saloon has a Fixture Name Path Traversal Vulnerability ### Impact Users with MockResponse fixtures that use path traversal. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description Fixture names were used to build file paths under the configured fixture directory without validation. A name containing path segments (e.g. ../traversal or ../../etc/passwd) resulted in a path outside that directory. When the application read a fixture (e.g. for mocking) or wrote one (e.g. when recording responses), it could read or write files anywhere the process had access. If the fixture name was derived from user or attacker-controlled input (e.g. request parameters or config), this constituted a path traversal vulnerability and could lead to disclosure of sensitive files or overwriting of critical files. The fix adds validation in the fixture layer (rejecting names with /, \, .., or null bytes, and restricting to a safe character set) and defence-in-depth in the storage layer (ensuring the resolved path remains under the base directory before any read or write). ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.

4.0.0
Affected by 0 other vulnerabilities.

VCID-a7cx-bfp9-r7dp
Aliases:
CVE-2026-33942
GHSA-rf88-776r-rcq9

Saloon has insecure deserialization in AccessTokenAuthenticator ### Impact Users of the OAuth2 utilities in Saloon, specifically the `AccessTokenAuthenticator` class. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description The Saloon PHP library used PHP's unserialize() in AccessTokenAuthenticator::unserialize() to restore OAuth token state from cache or storage, with allowed_classes => true. An attacker who can control the serialized string (e.g. by overwriting a cached token file or via another injection) can supply a serialized "gadget" object. When unserialize() runs, PHP instantiates that object and runs its magic methods (__wakeup, __destruct, etc.), leading to object injection. In environments with common dependencies (e.g. Monolog), this can be chained to remote code execution (RCE). The fix removes PHP serialization from the AccessTokenAuthenticator class requiring users to store and resolve the authenticator manually. ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @jonpurvis for applying the fix.

4.0.0
Affected by 0 other vulnerabilities.

VCID-wnrn-gpbe-effq
Aliases:
CVE-2026-33182
GHSA-c83f-3xp6-hfcp

Saloon is vulnerable to SSRF and credential leakage via absolute URL in endpoint overriding base URL ### Impact Users providing user generated input into the `resolveEndpoint` method on requests. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description When building the request URL, Saloon combined the connector's base URL with the request endpoint. If the endpoint was a valid absolute URL (e.g. https://attacker.example.com/callback), the code used that URL as-is and ignored the base URL. The request—and any authentication headers, cookies, or tokens attached by the connector—was then sent to the attacker-controlled host. If the endpoint could be influenced by user input or configuration (e.g. redirect_uri, callback URL), this allowed server-side request forgery (SSRF) and/or credential leakage to a third-party host. The fix (in the next major version) is to reject absolute URLs in the endpoint: URLHelper::join() throws InvalidArgumentException when the endpoint is a valid absolute URL, unless explicitly allowed, requiring callers to opt-in to the functionality on a per-connector or per-request basis. ### Credits Saloon thanks @HuajiHD for finding the issue and recommending solutions and @JonPurvis for applying the fix.

4.0.0
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-06T07:37:22.003580+00:00	GitLab Importer	Affected by	VCID-a7cx-bfp9-r7dp	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/saloonphp/saloon/CVE-2026-33942.yml	38.6.0
2026-06-06T07:34:38.548822+00:00	GitLab Importer	Affected by	VCID-wnrn-gpbe-effq	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/saloonphp/saloon/CVE-2026-33182.yml	38.6.0
2026-06-06T07:34:12.614839+00:00	GitLab Importer	Affected by	VCID-96sf-jhes-2ff2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/saloonphp/saloon/CVE-2026-33183.yml	38.6.0