OroPlatform vulnerable to path traversal during temporary file manipulations
Impact
Path Traversal is possible in Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName.
With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. The file will be deleted immediately after the script ends.
Workarounds
Apply patch
--- a/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
+++ b/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php
@@ -614,6 +614,10 @@
*/
public function getTemporaryFileName(string $suggestedFileName = null): string
{
+ if ($suggestedFileName) {
+ $suggestedFileName = basename($suggestedFileName);
+ }
+
$tmpDir = ini_get('upload_tmp_dir');
if (!$tmpDir || !is_dir($tmpDir) || !is_writable($tmpDir)) {
$tmpDir = sys_get_temp_dir();Or decorate Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName in your customization and clear $suggestedFileName argument
public function getTemporaryFileName(string $suggestedFileName = null): string
{
if ($suggestedFileName) {
$suggestedFileName = basename($suggestedFileName);
}
return parent::getTemporaryFileName($suggestedFileName);
}References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | oro/platform | >= 4.1.0, <= 4.1.13, >= 4.2.0, <= 4.2.10, >= 5.0.0, < 5.0.8 | 5.0.8 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H- Weakness (CWE)
CWE-22- Platform
- Composer
- Package
oro/platform- Disclosed
- 27.11.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9v3j-4j64-p937 - CC BY 4.0
Vulnerability history: oro/platform
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 01.2022 05.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 5
Disclosures per year
- 2022: 3
- 2023: 1
- 2024: 2
- 2025: 0
- 2026: 0
-
OroPlatform vulnerable to path traversal during temporary file manipulations this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.