Iliaal

FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to the process-wide OS environment via os.Setenv, leaking values across concurrent requests. Attackers reaching a request path that spawns child processes with the default environment through proc open or exec can read secrets such as database passwords set by other requests.

A decompression-bomb size-cap bypass exists in ZipArchiver and GPMInstaller. The system calculates the uncompressed size by summing the values declared in each entry's ZIP central-directory header via `ZipArchive::statIndex()['size']` and compares this against `system.gpm.archive.max uncompressed size` before extraction. Since the declared size can be forged and is not verified against the actual inflated stream, a specially crafted archive with small declared per-entry sizes can bypass the limit. When `extractTo()` is called, the actual larger content is written, which can lead to disk exhaustion or inode depletion. This requires the archive to be provided by a package source or an administrator upload.

A Twig sandbox bypass allows a page author, specifically any user with `admin.pages` permissions or those capable of writing to `user/pages`, to exfiltrate configuration secrets. While the sandbox attempts to redact the `config` variable and remove `Config::get` and `toArray` from the method allowlist, the actual Config object is still accessible through the allow-listed `grav.offsetGet('config')` method. By using allow-listed object-dumping filters such as `json encode`, `print r`, or `yaml encode`, an attacker can serialize the object at the PHP level, bypassing the sandbox method gate. This exposes the complete configuration tree, including sensitive data like SMTP credentials, API keys, and plugin database credentials.

A flaw in the binary installation flow allows a package bin entry containing `..` path segments to resolve outside the package installation directory. This can lead to the system changing the permissions of an existing host file to world-readable and world-executable modes during the execution of composer install, update, or require operations.

When run with -vvv debug verbosity, the software may print credentials embedded in the username slot of a repository or package URL (for example, a GitHub Personal Access Token in https://TOKEN@host/) to the debug output. This occurs because the `AuthHelper`, `Url::sanitize`, and `ProcessExecutor` functions do not sanitize username-only URL credentials.

Composer, a dependency manager for the PHP language, fails to correctly validate package names from untrusted repositories other than Packagist.org or Private Packagist. This allows a maliciously crafted package to cause the application to write attacker-controlled files outside the vendor directory and outside the project during install or update operations.

CookieJar incorrectly accepts cookies with a dot-only `Domain` attribute (such as `Domain=.`, `Domain=..`, `Domain=...`) and whitespace-padded variants. The `SetCookie::matchesDomain()` function removes leading dots, normalizing dot-only values to an empty string. Because `SetCookie::validate()` only rejected strictly empty domains, these cookies were stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin requested by an application using a shared cookie jar can set a cookie that is subsequently sent to unrelated hosts. This can lead to cookie injection or session fixation against downstream services. This issue affects applications using Guzzle's cookie support, such as `new Client(['cookies' => true])` or an explicit shared `CookieJar`, when the same jar is reused across attacker-controlled and trusted origins.

guzzlehttp/psr7 fails to reject Carriage Return (CR) and Line Feed (LF) characters in specific HTTP start-line fields, including the request method, protocol version, and response reason phrase. This occurs when attacker-controlled data is placed in these fields and subsequently serialized as raw HTTP/1.x using functions such as `Message::toString()` or equivalent serializers. The issue can also be triggered via `Message::parseRequest()` or `Message::parseResponse()` when malformed raw messages are parsed into PSR-7 objects and then re-serialized. For exploitation to occur, the malformed message must be serialized and processed by software that does not independently reject malformed start lines. This may lead to header injection, response splitting, request smuggling, or cache poisoning. Applications using standard Guzzle HTTP client APIs are not expected to be affected; the risk is higher for those manually serializing messages, forwarding raw HTTP, or implementing custom transports, proxying, and webhooks.