| Package | Affected versions | Patched versions |
|---|---|---|
| development system | < 3.5.22.20 | 3.5.22.20 |
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before installation, resulting in local privilege escalation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free