Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-puj3-khrf-hfa6
Vulnerability ID VCID-puj3-khrf-hfa6
Aliases GHSA-mwvh-p3hx-x4gg
Summary Ibexa Kernel's files with block listed extensions can be still saved to drafts File validation can be configured to reject certain files by file type. When this happens, validation fails, and the content can't be published. However, the file can be saved when saving the content draft. This means unwanted files can be present in storage, even if they are not easily accessible due to the content not being published. The fix ensures these unwanted file types are never stored. An attacker would need to have existing access to create content with a file field type to exploit this.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://developers.ibexa.co/security-advisories/ibexa-sa-2024-002-file-validation-and-workflow-stages
https://github.com/ezsystems/ezplatform-kernel
https://github.com/ezsystems/ezplatform-kernel/commit/7e472317f7c75f45f72f74c38406952d8bea0de1
GHSA-mwvh-p3hx-x4gg https://github.com/advisories/GHSA-mwvh-p3hx-x4gg
GHSA-mwvh-p3hx-x4gg https://github.com/ezsystems/ezplatform-kernel/security/advisories/GHSA-mwvh-p3hx-x4gg
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:47:24.384942+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/ezsystems/ezplatform-kernel/GHSA-mwvh-p3hx-x4gg.yml 38.6.0