CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony UX versions prior to 2.36.1 and 3.2.0, allowing the ux:install console command to potentially write attacker-controlled content to arbitrary locations or read sensitive local files due to improper handling of relative paths. This poses a significant risk of unauthorized file manipulation and data exposure. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate these security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the recipe directory. This issue is fixed in versions 2.36.1 and 3.2.0.