Search for packages
| purl | pkg:composer/silverstripe/assets@1.1.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-vv3r-fxqp-vr3f
Aliases: CVE-2022-38147 GMS-2022-6854 |
XSS via uploaded gpx file A malicious content author could upload a GPX file with a Javascript payload. The payload … |
Vulnerable |
|
GHSA-9cx2-hj6m-fv58
Aliases: CVE-2022-38724 GMS-2022-6853 |
Silverstripe XSS in shortcodes A malicious content author could add arbitrary attributes to HTML editor shortcodes which could be used … |
Vulnerable |
|
GHSA-v68g-62v9-39w5
Aliases: CVE-2022-29858 |
Unpublished, protected files can be published via shortcode Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows … |
Vulnerable |
|
GHSA-592m-4533-rxq9
Aliases: CVE-2020-9280 |
SilverStripe Folders migrated from 3.x may be unsafe to upload to In SilverStripe through 4.5, files uploaded via Forms to … |
Vulnerable |
|
GHSA-jvx5-rm6q-gx7p
Aliases: CVE-2019-12245 |
Lack of access control on upoaded files SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). … |
Vulnerable |
|
GHSA-jgcf-rf45-2f8v
Aliases: CVE-2026-24749 |
Silverstripe Assets Module has a DBFile::getURL() permission bypass ### Impact Images rendered in templates or otherwise accessed via `DBFile::getURL()` or … |
Not vulnerable |