Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
Impact
Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers.
Patches
Workarounds
Any of the below actions can be taken to prevent the issue:
- Validate input before calling
setLocale(), for instance by forbidding or removing/and\ - Call
setLocale()only with a locale from a whitelist of supported locales - When uploading files, rename them so they cannot have a
.phpextension (this is recommended even if you're not affected by this issue) - Prefer storage system that are not local to the application (remote service, or local service ran by another user so the uploaded files actually live outside of the application basedir)
References
https://en.wikipedia.org/wiki/File_inclusion_vulnerability
Credits
Thanks to Szczepan Hołyszewski who reported the issue and to Tidelift to coordinate the resolution
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | nesbot/carbon | >= 3.0.0, < 3.8.4, < 2.72.6 | 3.8.4, 2.72.6 |
Referencias
- https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q
- https://nvd.nist.gov/vuln/detail/CVE-2025-22145
- https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58
- https://github.com/CarbonPHP/carbon
- https://lists.debian.org/debian-lts-announce/2025/02/msg00032.html
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-98- Plataforma
- Composer
- Paquete
nesbot/carbon- Publicada
- 08.01.2025
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-j3f9-p6hm-5w6q - CC BY 4.0
Historial de vulnerabilidades: nesbot/carbon
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.