froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type

HIGH 8.8CVE-2023-2034 · GHSA-qwvp-g9j7-28f6 · Published 14/04/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
froxlor/froxlor Packagist	`< 2.0.14`	`2.0.14`
froxlor froxlor	`< 2.0.14`	`2.0.14`

Description

Image files uploaded in froxlor/froxlor prior to 2.0.14 were not properly validated which could result in remote code execution via path manipulation.

NVD description

Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.

References

nvd.nist.gov/vuln/detail/CVE-2023-2034 · ADVISORY
froxlor/froxlor commit f36bc61 · WEB
Froxlor/Froxlor · PACKAGE
huntr.dev/bounties/aba6beaa-570e-4523-8128-da4d8e374ef6 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free