{"id":"GHSA-3fvf-2gp4-89wq","summary":"Possibility for Denial of Service by overwriting PHP files with language exports","details":"### Impact\nLaravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.\n\n### Patches\nVersion 0.6.2 fixes this issue.\n\n### Workarounds\nOnly allow trusted admins to publish/edit translations.\n\n### References\nhttps://github.com/barryvdh/laravel-translation-manager/pull/417\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/barryvdh/laravel-translation-manager\n* Email me (see Github profile)\n\n### Credits\nFound and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)","modified":"2024-12-05T05:49:05.175657Z","published":"2022-03-18T23:17:15Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-03-18T23:17:15Z","nvd_published_at":null,"cwe_ids":[],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/barryvdh/laravel-translation-manager/security/advisories/GHSA-3fvf-2gp4-89wq"},{"type":"PACKAGE","url":"https://github.com/barryvdh/laravel-translation-manager"}],"affected":[{"package":{"name":"barryvdh/laravel-translation-manager","ecosystem":"Packagist","purl":"pkg:composer/barryvdh/laravel-translation-manager"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2"}]}],"versions":["v0.1.0","v0.1.1","v0.1.2","v0.1.3","v0.1.4","v0.2.0","v0.2.1","v0.2.2","v0.2.3","v0.2.4","v0.2.5","v0.2.6","v0.2.7","v0.2.8","v0.2.9","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.5.0","v0.5.1","v0.5.10","v0.5.2","v0.5.3","v0.5.4","v0.5.5","v0.5.6","v0.5.7","v0.5.8","v0.5.9","v0.6.0","v0.6.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-3fvf-2gp4-89wq/GHSA-3fvf-2gp4-89wq.json"}}],"schema_version":"1.9.0"}