🚨 CRITICAL - PHAR deserialization via unvalidated file_exists() path handling (CVE-2023-28115) Snappy (knplabs/knp-snappy) before 1.4.2 is vulnerable to PHAR deserialization because it passes attacker-controlled paths into file_exists() without validating the protocol/scheme. The root cause is improper input validation enabling PHP object deserialization through the phar:// stream wrapper (PHAR deserialization / insecure deserialization). An attacker with the ability to upload a file (or otherwise control a path that reaches the affected code) can supply a phar:// URI to trigger metadata deserialization and instantiate arbitrary PHP objects, especially dangerous in Laravel/Symfony environments with known POP chains. Successful exploitation can lead to remote code execution, full application compromise, and follow-on data theft or service takeover. 👉 Affected: knplabs/knp-snappy < 1.4.2 | Upgrade to 1.4.2
Post summary
This advisory discloses a critical PHAR deserialization flaw in knplabs/knp-snappy before version 1.4.2, outlines the mechanism and impact, and recommends upgrading to 1.4.2.