A Remote Code Execution vulnerability has been found in the Horde_Image library when using the "Im" backend that utilizes ImageMagick's "convert" utility. It's not exploitable through any Horde application, because the code path to the vulnerability is not used by any Horde code....
Product
horde image api vulnerabilities
2 published CVES affecting horde image api, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest horde image api CVEs
Newest publication first
-
HighCVSS 8.1 EPSS 4.0%
-
HighCVSS 8.8 EPSS 2.4%
Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.