Security Digest · page 2 of 3
Critical Composer (PHP) advisories (page 2)
244 critical advisories for Composer (PHP) packages since October 2023, newest first. Check your project with composer audit.
- Winter vulnerable to privilege escalation by authenticated backend users CVE-2026-27591 CVSS 9.9 Critical
winter/wn-backend-module>= 1.2.0, < 1.2.12 → fixed in 1.2.12;winter/wn-backend-module>= 1.1.0, < 1.1.12 → fixed in 1.1.12;winter/wn-backend-module< 1.0.477 → fixed in 1.0.477 - Craft CMS Vulnerable to Authenticated RCE via "craft.app.fs.write()" in Twig Templates CVE-2026-28697 CVSS 9.4 Critical
craftcms/cms>= 5.0.0-RC1, < 5.9.0-beta.1 → fixed in 5.9.0-beta.1;craftcms/cms>= 4.0.0-RC1, < 4.17.0-beta.1 → fixed in 4.17.0-beta.1 - WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php CVE-2026-29058 CVSS 9.8 Critical
wwbn/avideo< 7.0.0 → fixed in 7.0.0 - Froxlor has Admin-to-Root Privilege Escalation via Input Validation Bypass + OS Command Injection CVE-2026-26279 CVSS 9.1 Critical
froxlor/froxlor<= 2.3.3 → fixed in 2.3.4 - OpenSTAManager affected by unauthenticated privilege escalation via modules/utenti/actions.php CVE-2026-27012 CVSS 9.8 Critical
devcode-it/openstamanager<= 2.9.8 → no fix listed - AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction CVE-2026-28502 CVSS 9.3 Critical
wwbn/avideo< 21.0 → no fix listed - AVideo has Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php CVE-2026-28501 CVSS 9.8 Critical
wwbn/avideo<= 21.0.0 → no fix listed - Idno Vulnerable to Unauthenticated SSRF via URL Unfurl Endpoint CVE-2026-28508 CVSS 9.2 Critical
idno/known<= 1.6.3 → fixed in 1.6.4 - Statamic is vulnerable to account takeover via password reset link injection CVE-2026-27593 CVSS 9.3 Critical
statamic/cms< 5.73.10 → fixed in 5.73.10;statamic/cms>= 6.0.0-alpha.1, < 6.7.1 → fixed in 6.7.1 - Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVE-2026-26016 CVSS 9.2 Critical
pterodactyl/panel< 1.12.1 → fixed in 1.12.1 - Known affected by Account Takeover via Password Reset Token Leakage CVE-2026-26273 CVSS 9.8 Critical
idno/known<= 1.6.2 → fixed in 1.6.3 - OpenSTAManager has an OS Command Injection in P7M File Processing CVE-2025-69212 CVSS 9.4 Critical
devcode-it/openstamanager<= 2.9.8 → no fix listed - CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor CVE-2026-25510 CVSS 9.9 Critical
ci4-cms-erp/ci4ms< 0.28.5.0 → fixed in 0.28.5.0 - Laravel Redis Horizontal Scaling Insecure Deserialization CVE-2026-23524 CVSS 9.8 Critical
laravel/reverb< 1.7.0 → fixed in 1.7.0 - Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component CVE-2025-67165 CVSS 9.8 Critical
pagekit/pagekit<= 1.0.18 → no fix listed - Pagekit CMS is vulnerable to OS Command Injection via Storage component CVE-2025-67164 CVSS 9.9 Critical
pagekit/pagekit<= 1.0.18 → no fix listed - Grav may be vulnerable to SSRF attack via Twig Templates CVE-2025-66844 CVSS 9.1 Critical
getgrav/grav<= 1.7.49.5 → no fix listed - MineAdmin has an insecure default password CVE-2025-65854 CVSS 9.8 Critical
mineadmin/mineadmin<= 3.0.9 → no fix listed - Ibexa User Bundle is missing password change validation CVE-2025-67719 CVSS 9.3 Critical
ibexa/user>= 5.0.0-beta1, < 5.0.4 → fixed in 5.0.4 - Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”) CVE-2025-67510 CVSS 9.4 Critical
neuron-core/neuron-ai<= 2.8.11 → fixed in 2.8.12 - SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475 GHSA-5j8p-438x-rgg5 CVSS 9.3 Critical
onelogin/php-saml< 2.21.1 → fixed in 2.21.1;onelogin/php-saml>= 3.0.0, < 3.8.1 → fixed in 3.8.1;onelogin/php-saml>= 4.0.0, < 4.3.1 → fixed in 4.3.1 - Mautic user without privileged access to the Marketplace can install and uninstall composer packages CVE-2025-13828 CVSS 9.0 Critical
mautic/core>= 4.0.0, < 4.4.18 → fixed in 4.4.18;mautic/core>= 5.0.0, < 5.2.9 → fixed in 5.2.9;mautic/core>= 6.0.0, < 6.0.7 → fixed in 6.0.7 - bagisto has CSV Formula Injection in Create New Product CVE-2025-62417 CVSS 9.0 Critical
bagisto/bagisto<= 2.3.7 → fixed in 2.3.8 - PrestaShop Checkout allows customer account takeover via email CVE-2025-61922 CVSS 9.1 Critical
prestashop/ps_checkout>= 5.0.0, < 5.0.5 → fixed in 5.0.5;prestashop/ps_checkout>= 1.3.0, < 4.4.1 → fixed in 4.4.1 - Melis Platform CMS Unauthenticated Admin Account Creation CVE-2025-10352 CVSS 9.3 Critical
melisplatform/melis-core< 5.3.11 → fixed in 5.3.11 - Melis Platform CMS SQL Injection CVE-2025-10351 CVSS 9.3 Critical
melisplatform/melis-cms< 5.3.4 → fixed in 5.3.4 - Melis Platform CMS Unauthenticated File Upload Leading to RCE CVE-2025-10353 CVSS 9.3 Critical
melisplatform/melis-cms-slider< 5.3.1 → fixed in 5.3.1 - Magento Community Edition Improper Input Validation vulnerability CVE-2025-54236 CVSS 9.1 Critical
magento/community-edition<= 2.4.5-p14 → no fix listed;magento/community-edition= 2.4.6 → no fix listed;magento/community-edition>= 2.4.6-p1, <= 2.4.6-p12 → no fix listed; +8 more packages - The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability CVE-2025-52122 CVSS 9.8 Critical
solspace/craft-freeform>= 5.0.0, < 5.10.16 → fixed in 5.10.16 - ThinkPHP Path Traversal Vulnerability CVE-2025-50706 CVSS 9.3 Critical
topthink/framework<= 5.1.41 → no fix listed - The ADOdb sqlite3 driver allows SQL injection CVE-2025-54119 CVSS 10.0 Critical
adodb/adodb-php<= 5.22.9 → fixed in 5.22.10 - CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability CVE-2025-54418 CVSS 9.8 Critical
codeigniter4/framework< 4.6.2 → fixed in 4.6.2 - nova-tiptap has Unauthenticated Arbitrary File Upload Vulnerability CVE-2025-54082 CVSS 9.3 Critical
marshmallow/nova-tiptap< 5.7.0 → fixed in 5.7.0;manogi/nova-tiptap<= 3.2.6 → no fix listed - simogeo/filemanager arbitrary file upload vulnerability CVE-2025-46001 CVSS 9.8 Critical
simogeo/filemanager< 2.5.0 → no fix listed - Livewire is vulnerable to remote command execution during component property update hydration CVE-2025-54068 CVSS 9.2 Critical
livewire/livewire>= 3.0.0-beta.1, < 3.6.4 → fixed in 3.6.4 - LaRecipe is vulnerable to Server-Side Template Injection attacks CVE-2025-53833 CVSS 10.0 Critical
binarytorch/larecipe< 2.8.1 → fixed in 2.8.1 - Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution CVE-2025-49132 CVSS 10.0 Critical
pterodactyl/panel<= 1.11.10 → fixed in 1.11.11 - Magneto contains stored XSS vulnerability CVE-2025-47110 CVSS 9.1 Critical
magento/community-edition>= 2.4.8-beta1, < 2.4.8-p1 → fixed in 2.4.8-p1;magento/community-edition>= 2.4.7-beta1, < 2.4.7-p6 → fixed in 2.4.7-p6;magento/community-edition< 2.4.5-p13 → fixed in 2.4.5-p13; +5 more packages - laravel-auth0 SDK Deserialization of Untrusted Data vulnerability GHSA-c42h-56wx-h85q CVSS 9.3 Critical
auth0/login>= 7.0.0-BETA1, <= 7.2.1 → fixed in 7.2.2 - Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability GHSA-98j6-67v3-mw34 CVSS 9.3 Critical
auth0/symfony>= 5.0.0-BETA0, <= 5.0.0 → fixed in 5.1.0 - Auth0-PHP SDK Deserialization of Untrusted Data vulnerability CVE-2025-48951 CVSS 9.3 Critical
auth0/auth0-php>= 8.0.0-BETA3, < 8.3.1 → fixed in 8.3.1 - Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data GHSA-862m-5253-832r CVSS 9.3 Critical
auth0/wordpress>= 5.0.0-BETA0, <= 5.0.1 → fixed in 5.1.0 - Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization CVE-2025-49113 CVSS 9.9 Critical
roundcube/roundcubemail< 1.5.10 → fixed in 1.5.10;roundcube/roundcubemail>= 1.6.0, < 1.6.11 → fixed in 1.6.11 - The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution CVE-2025-48200 CVSS 10.0 Critical
sjbr/sr-feuser-register>= 5.1.0, < 12.5.0 → fixed in 12.5.0 - Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-9wg9-93h9-j8ch CVSS 9.1 Critical
auth0/symfony< 5.4.0 → fixed in 5.4.0 - laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-9fwj-9mjf-rhj3 CVSS 9.1 Critical
auth0/login< 7.17.0 → fixed in 7.17.0 - Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions GHSA-2f4r-34m4-3w8q CVSS 9.1 Critical
auth0/wordpress< 5.3.0 → fixed in 5.3.0 - Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275 CVSS 9.1 Critical
auth0/auth0-php>= 8.0.0-BETA1, < 8.14.0 → fixed in 8.14.0 - SQL injection in ADOdb PostgreSQL driver pg_insert_id() method CVE-2025-46337 CVSS 10.0 Critical
adodb/adodb-php<= 5.22.8 → fixed in 5.22.9 - YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download CVE-2025-46348 CVSS 10.0 Critical
yeswiki/yeswiki<= 4.5.3 → fixed in 4.5.4 - ShowDoc unrestricted file upload vulnerability CVE-2025-0520 CVSS 9.4 Critical
showdoc/showdoc< 2.8.7 → fixed in 2.8.7 - Craft CMS Allows Remote Code Execution CVE-2025-32432 CVSS 10.0 Critical
craftcms/cms>= 3.0.0-RC1, <= 3.9.14 → fixed in 3.9.15;craftcms/cms>= 4.0.0-RC1, <= 4.14.14 → fixed in 4.14.15;craftcms/cms>= 5.0.0-RC1, <= 5.6.16 → fixed in 5.6.17 - DevDojo Voyager Argument Injection vulnerability CVE-2025-32931 CVSS 9.1 Critical
tcg/voyager>= 1.4.0, <= 1.8.0 → no fix listed - yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key CVE-2024-58136 CVSS 9.0 Critical
yiisoft/yii2< 2.0.52 → fixed in 2.0.52 - RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency CVE-2025-22871 CVSS 9.1 Critical
spiral/roadrunner< 2025.1.0 → fixed in 2025.1.0 - Volt Allows RCE Via User-Crafted Requests CVE-2025-27517 CVSS 9.3 Critical
livewire/volt< 1.7.0 → fixed in 1.7.0 - Mautic allows Remote Code Execution and File Deletion in Asset Uploads CVE-2024-47051 CVSS 9.1 Critical
mautic/core< 5.2.3 → fixed in 5.2.3 - Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header GHSA-c2p2-hgjg-9r3f CVSS 9.5 Critical
islandora/crayfish<= 4.0.0 → no fix listed - Easy!Appointments Improper Restriction of Excessive Authentication Attempts CVE-2024-57602 CVSS 9.8 Critical
alextselegidis/easyappointments<= 1.5.0 → no fix listed - Improper Authorization vulnerability in Magento and Adobe Commerce CVE-2025-24434 CVSS 9.1 Critical
magento/community-edition>= 2.4.8-beta1, < 2.4.8-beta2 → fixed in 2.4.8-beta2;magento/community-edition>= 2.4.7-beta1, < 2.4.7-p4 → fixed in 2.4.7-p4;magento/community-edition>= 2.4.6-p1, < 2.4.6-p9 → fixed in 2.4.6-p9; +3 more packages - Multiple rtmpdump vulnerabilities GHSA-vrpv-vw92-328g
rudloff/rtmpdump-bin<= 2.3.1 → no fix listed - Crayfish allows Remote Code Execution via Homarus Authorization header CVE-2025-25286 CVSS 9.8 Critical
islandora/crayfish< 4.1.0 → fixed in 4.1.0 - TeamPass privileges issue CVE-2024-50703 CVSS 9.3 Critical
nilsteampassnet/teampass< 3.1.3.1 → fixed in 3.1.3.1 - Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled CVE-2024-56145 CVSS 9.3 Critical
craftcms/cms>= 5.0.0-RC1, < 5.5.2 → fixed in 5.5.2;craftcms/cms>= 4.0.0-RC1, < 4.13.2 → fixed in 4.13.2;craftcms/cms>= 3.0.0, < 3.9.14 → fixed in 3.9.14 - LibreNMS has an Authenticated OS Command Injection CVE-2024-51092 CVSS 9.1 Critical
librenms/librenms<= 24.9.1 → fixed in 24.10.0 - Deserialization of Untrusted Data in dompdf/dompdf CVE-2021-3838 CVSS 9.8 Critical
dompdf/dompdf< 2.0.0 → fixed in 2.0.0 - Improper Restriction of XML External Entity Reference in dompdf/dompdf CVE-2021-3902 CVSS 9.8 Critical
dompdf/dompdf< 2.0.0 → fixed in 2.0.0 - ThinkPHP deserialization vulnerability CVE-2024-44902 CVSS 9.3 Critical
topthink/framework>= 6.1.3, <= 8.0.4 → no fix listed - Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVE-2024-38529 CVSS 9.3 Critical
admidio/admidio< 4.3.10 → fixed in 4.3.10 - Admidio has Blind SQL Injection in ecard_send.php CVE-2024-37906 CVSS 9.4 Critical
admidio/admidio< 4.3.9 → fixed in 4.3.9 - RaspAP allows an attacker to escalate privileges CVE-2024-41637 CVSS 9.4 Critical
billz/raspap-webgui<= 3.1.4 → no fix listed - TorrentPier Deserialization of Untrusted Data vulnerability CVE-2024-40624 CVSS 9.3 Critical
torrentpier/torrentpier<= 2.4.3 → fixed in 2.4.4 - Craft CMS SQL injection vulnerability via the GraphQL API endpoint CVE-2024-37843 CVSS 9.3 Critical
craftcms/cms<= 3.7.31 → no fix listed - Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability CVE-2024-34102 CVSS 9.8 Critical
magento/community-edition= 2.4.4 → no fix listed;magento/community-edition>= 2.4.6-p1, < 2.4.6-p6 → fixed in 2.4.6-p6;magento/community-edition>= 2.4.5-p1, < 2.4.5-p8 → fixed in 2.4.5-p8; +4 more packages - Magento Open Source Improper Authentication vulnerability CVE-2024-34103 CVSS 9.2 Critical
magento/community-edition= 2.4.7 → no fix listed;magento/community-edition= 2.4.6 → no fix listed;magento/community-edition= 2.4.5 → no fix listed; +4 more packages - willdurand/js-translation-bundle potential path traversal attack and remote code injection GHSA-x86x-qhf8-f37w CVSS 9.8 Critical
willdurand/js-translation-bundle< 2.1.1 → fixed in 2.1.1 - Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) GHSA-v42g-7q2x-cw32 CVSS 9.8 Critical
zendframework/zendframework1>= 1.12.0, < 1.12.16 → fixed in 1.12.16 - ZendFramework potential SQL Injection Vector When Using PDO_MySql GHSA-qf36-fx9f-232x CVSS 9.8 Critical
zendframework/zendframework1>= 1.10.0, < 1.10.9 → fixed in 1.10.9;zendframework/zendframework1>= 1.11.0, < 1.11.6 → fixed in 1.11.6 - Zendframework vulnerable to XXE/XEE attacks GHSA-qc7w-4567-84wv CVSS 9.8 Critical
zendframework/zendframework>= 2.1.0, < 2.1.6 → fixed in 2.1.6;zendframework/zendframework>= 2.2.0, < 2.2.6 → fixed in 2.2.6 - ZendFramework potential XML eXternal Entity injection vectors GHSA-mhpx-3rv8-wrjm CVSS 9.8 Critical
zendframework/zendframework1>= 1.12.0, < 1.12.4 → fixed in 1.12.4 - ZendFramework vulnerable to XXE/XEE attacks GHSA-f4fj-q6m4-cc52 CVSS 9.8 Critical
zendframework/zend-xmlrpc>= 2.1.0, < 2.1.6 → fixed in 2.1.6;zendframework/zend-xmlrpc>= 2.2.0, < 2.2.6 → fixed in 2.2.6 - Zend-JSON vulnerable to XXE/XEE attacks GHSA-8x2v-pcg7-94f4 CVSS 9.8 Critical
zendframework/zend-json>= 2.1.0, < 2.1.6 → fixed in 2.1.6;zendframework/zend-json>= 2.2.0, < 2.2.6 → fixed in 2.2.6 - Zendframework1 Potential SQL injection in ORDER and GROUP functions GHSA-6fqw-j3vm-7f66 CVSS 9.8 Critical
zendframework/zendframework1< 1.12.20 → fixed in 1.12.20 - ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select GHSA-2x36-qhx3-7m5f CVSS 9.8 Critical
zendframework/zendframework1>= 1.12.0, < 1.12.7 → fixed in 1.12.7 - Missing Access Check in TYPO3 CMS GHSA-gwfx-p7mr-f92v CVSS 9.0 Critical
typo3/cms>= 6.2.0, < 6.2.25 → fixed in 6.2.25;typo3/cms>= 7.6.0, < 7.6.8 → fixed in 7.6.8;typo3/cms>= 8.0.0, < 8.1.1 → fixed in 8.1.1 - Arbitrary Code Execution in TYPO3 CMS GHSA-67wg-6j7r-mqh8 CVSS 9.9 Critical
typo3/cms>= 7.6.0, < 7.6.22 → fixed in 7.6.22;typo3/cms>= 8.0.0, < 8.7.5 → fixed in 8.7.5 - titon/framework vulnerable to Remote Code Execution via Chosen-Ciphertext Attack GHSA-q3jm-v27q-jfww CVSS 9.8 Critical
titon/framework<= 0.1.0-alpha → no fix listed - Symfony XML decoding attack vector through external entities GHSA-mmcv-fvq8-r9x3 CVSS 9.8 Critical
symfony/symfony>= 2.0.0, < 2.0.11 → fixed in 2.0.11 - TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution GHSA-cc97-g92w-jm65 CVSS 9.8 Critical
typo3/cms-core>= 8.0.0, < 8.7.17 → fixed in 8.7.17;typo3/cms-core>= 9.0.0, < 9.3.2 → fixed in 9.3.2;typo3/cms-core>= 7.0.0, < 7.6.30 → fixed in 7.6.30 - Symfony XML decoding attack vector through external entities GHSA-j68w-pg49-f6vx CVSS 9.8 Critical
symfony/serializer>= 2.0.0, < 2.0.11 → fixed in 2.0.11 - Swiftmailer Sendmail transport arbitrary shell execution GHSA-4qpj-gxxg-jqg4
swiftmailer/swiftmailer>= 4.0.0, < 5.2.1 → fixed in 5.2.1 - Dolibarr vulnerable to SQL Injection CVE-2024-5315 CVSS 9.1 Critical
dolibarr/dolibarr<= 9.0.1 → no fix listed - Dolibarr vulnerable to SQL Injection CVE-2024-5314 CVSS 9.1 Critical
dolibarr/dolibarr<= 9.0.1 → no fix listed - Silverstripe Brute force bypass on default admin GHSA-8v6m-7f5v-hhx6 CVSS 9.1 Critical
silverstripe/framework>= 3.1.18, < 3.1.19 → fixed in 3.1.19;silverstripe/framework>= 3.2.3, < 3.2.4 → fixed in 3.2.4;silverstripe/framework>= 3.3.1, < 3.3.2 → fixed in 3.3.2 - VuFind Server-Side Request Forgery (SSRF) vulnerability CVE-2024-25738 CVSS 9.1 Critical
vufind/vufind>= 2.0, < 9.1.1 → fixed in 9.1.1 - VuFind Server-Side Request Forgery (SSRF) vulnerability CVE-2024-25737 CVSS 9.1 Critical
vufind/vufind>= 2.4, < 9.1.1 → fixed in 9.1.1 - Shopware Remote Code Execution Vulnerability GHSA-q3g4-2vw9-xv27 CVSS 9.8 Critical
shopware/shopware>= 4.0.0, < 5.2.15 → fixed in 5.2.15;shopware/shopware< 1.0.8 → fixed in 1.0.8 - Shopware Remote Code Execution Vulnerability GHSA-83jv-4prm-34g7 CVSS 9.8 Critical
shopware/shopware>= 4.2.0, < 5.2.25 → fixed in 5.2.25 - Shopware Remote Code Execution Vulnerability GHSA-7336-ghhp-f2qj CVSS 9.8 Critical
shopware/shopware= 5.2.15 → fixed in 5.2.16 - Propel2 SQL injection possible with limit() on MySQL GHSA-7vw7-qx38-37vr CVSS 9.8 Critical
propel/propel>= 2.0.0-alpha1, <= 2.0.0-alpha7 → fixed in 2.0.0-alpha8