Security advisory: IBEXA-SA-2024-003

Vulnerability in image-optimizer dependency
Publication date:
14/05/2024, 11:30


Affected versions: Ibexa DXP v4.6.* (ibexa/image-editor)
Resolving versions: Ibexa DXP v4.6.4

The dependency spatie/image-optimizer has a moderate vulnerability in versions lower than 1.7.3, potentially allowing PHAR deserialization. This is registered as CVE-2024-34515. This dependency was used in Ibexa DXP up to v4.6.3, and resolved in v4.6.4. In v4.6.5 the dependency requirement was also upgraded, with the effect of banning the vulnerable versions. 

By default, Ibexa DXP blocks the PHAR filetype from being uploaded, so this vulnerability is unlikely to have been exploitable.

However, it is always recommended to ensure you don't have packages with known vulnerabilities installed.

Have you found a security bug in Ibexa DXP? See how to report it responsibly here:

All security advisories