PT-2025-4381 · Carbon+1 · Carbon+1

Szczepan Hołyszewski · Published 2025-01-08 · Updated 2025-03-16 · CVE-2025-22145

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Carbon versions prior to 3.8.4 Carbon versions prior to 2.72.6

Description The issue arises when applications pass unsanitized user input to Carbon::setLocale, putting them at risk of arbitrary file inclusion. If the application allows users to upload files with a .php extension in a folder that permits include or require to read it, they are at risk of arbitrary code execution on their servers.

Recommendations For versions prior to 3.8.4, update to version 3.8.4 or later. For versions prior to 2.72.6, update to version 2.72.6 or later. As a temporary workaround, consider validating input before calling setLocale(), such as forbidding or removing / and ``. Alternatively, call setLocale() only with a locale from a whitelist of supported locales. When uploading files, rename them so they cannot have a .php extension. Prefer storage systems that are not local to the application, such as remote services or local services run by another user.

Exploit

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-22145

DLA-4068-1

GHSA-J3F9-P6HM-5W6Q

Affected Products

Carbon

Debian

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22145.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-22145 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-22145 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3f9-p6hm-5w6q · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-22145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22145 · Security Note
• https://osv.dev/vulnerability/DLA-4068-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-22145 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-22145 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-22145 · Security Note
• https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58 · Note
• https://github.com/briannesbitt/Carbon/commit/1e9d50601e7035a4c61441a208cb5bed73e108c5 · Note
• https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q · Note
• https://github.com/CarbonPHP/carbon · Note
• https://reddit.com/r/Operatingsystems/comments/1jcy1dr/debian_12100_released · Reddit Post