PT-2026-95508
CVE-2026-93533
·
تاريخ النشر
2026-09-18
·
تاريخ التحديث
2026-11-12
الوصف من
CVSS 2.0
7.5
عاليةالمقاييسAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
spatie Scotty versions prior to 1.4.5
Description
OS command injection is possible via remote attack in the Doctor Command Handler component. The issue exists within the
DoctorCommand::checkSshConnectivity() and DoctorCommand::checkRemoteTools() functions located in the app/Commands/DoctorCommand.php file, where improper handling of the host argument allows for the execution of arbitrary operating system commands.Recommendations
As a temporary workaround, restrict access to the
DoctorCommand::checkSshConnectivity() and DoctorCommand::checkRemoteTools() functions until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.قابلية الاستغلال
استغلال
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾