| Package | Affected versions | Patched versions |
|---|---|---|
| xli | = 1.14= 1.15= 1.16= 1.17 |
xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free