Simplepie
Monthly
Local file disclosure in SimplePie through 1.9.0 lets a malicious or compromised feed server read files on the host running the PHP application: by replying to a feed request with an HTTP Location redirect - or by planting an autodiscovery <link> - that points at a file:// path, the library follows the reference and reads the target file into the parsed feed. Exploitation requires no privileges (PR:N) but does require the attacker to control the feed server's responses or inject a feed URL into the application (AC:H, AT:P), and disclosure is bounded to files readable by the web-server process. Vendor fix is available via upstream PR 991, public exploit code exists (a PoC targeting pfSense's RSS widget has been published), and no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Local file disclosure in SimplePie through 1.9.0 lets a malicious or compromised feed server read files on the host running the PHP application: by replying to a feed request with an HTTP Location redirect - or by planting an autodiscovery <link> - that points at a file:// path, the library follows the reference and reads the target file into the parsed feed. Exploitation requires no privileges (PR:N) but does require the attacker to control the feed server's responses or inject a feed URL into the application (AC:H, AT:P), and disclosure is bounded to files readable by the web-server process. Vendor fix is available via upstream PR 991, public exploit code exists (a PoC targeting pfSense's RSS widget has been published), and no confirmed active exploitation (CISA KEV) was identified at time of analysis.