Most recent entries from all

EUVD-2026-218780

fkie_cve-2025-22145

Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.

GHSA-j3f9-p6hm-5w6q — Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Affected: Packagist: nesbot/carbon

### Impact Application passing unsanitized user input to `Carbon::setLocale` are at risk of arbitrary file include, if the application allows users to upload files with `.php` extension in an folder that allows `include` or `require` to read it, then they are at risk of arbitrary code ran on their servers.

### Patches - [3.8.4](https://github.com/briannesbitt/Carbon/releases/tag/3.8.4) - [2.72.6](https://github.com/briannesbitt/Carbon/releases/tag/2.72.6)

### Workarounds Any of the below actions can be taken to prevent the issue: - Validate input before calling `setLocale()`, for instance by forbidding or removing `/` and `\` - Call `setLocale()` only with a locale from a whitelist of supported locales - When uploading files, rename them so they cannot have a `.php` extension (this is recommended even if you're not affected by this issue) - Prefer storage system that are not local to the application (remote service, or local service ran by another user so the uploaded files actually live outside of the application basedir)

### References https://en.wikipedia.org/wiki/File_inclusion_vulnerability

### Credits Thanks to **Szczepan Hołyszewski** who reported the issue and to Tidelift to coordinate the resolution

UBUNTU-CVE-2025-22145

Affected: Ubuntu:20.04:LTS: php-nesbot-carbon