SCA: security update for webklex/laravel-imap, webklex/php-imap (GHSA-47p7-xfcc-4pv9)

critical Tenable Cloud Security Plugin ID 410022

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed
/ enabled. Prior to version 5.3.0, an unsanitized attachment filename allows any unauthenticated user to
leverage a directory traversal vulnerability, which results in a remote code execution vulnerability.
Every application that stores attachments with `Attachment::save()` without providing a `$filename` or
passing unsanitized user input is affected by this attack. An attacker can send an email with a malicious
attachment to the inbox, which gets crawled with `webklex/php-imap` or `webklex/laravel-imap`.
Prerequisite for the vulnerability is that the script stores the attachments without providing a
`$filename`, or providing an unsanitized `$filename`, in `src/Attachment::save(string $path, string
$filename = null)`. In this case, where no `$filename` gets passed into the `Attachment::save()` method,
the package would use a series of unsanitized and insecure input values from the mail as fallback. Even if
a developer passes a `$filename` into the `Attachment::save()` method, e.g. by passing the name or
filename of the mail attachment itself (from email headers), the input values never get sanitized by the
package. There is also no restriction about the file extension (e.g. ".php") or the contents of a file.
This allows an attacker to upload malicious code of any type and content at any location where the
underlying user has write permissions. The attacker can also overwrite existing files and inject malicious
code into files that, e.g. get executed by the system via cron or requests. Version 5.3.0 contains a patch
for this issue. (CVE-2023-35169)

Plugin Details

Severity: Critical

ID: 410022

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.54

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-35169

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/21/2023

Vulnerability Publication Date: 6/21/2023

Reference Information

CVE: CVE-2023-35169

cwe: CWE-22

Detections

Analytics