{"id":"CVE-2025-22145","aliases":["GHSA-j3f9-p6hm-5w6q"],"url":"https://o3.security/vulnerability/CVE-2025-22145","summary":"Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale","details":"### Impact\nApplication passing unsanitized user input to `Carbon::setLocale` are at risk of arbitrary file include, if the application allows users to upload files with `.php` extension in an folder that allows `include` or `require` to read it, then they are at risk of arbitrary code ran on their servers.\n\n### Patches\n- [3.8.4](https://github.com/briannesbitt/Carbon/releases/tag/3.8.4)\n- [2.72.6](https://github.com/briannesbitt/Carbon/releases/tag/2.72.6)\n\n### Workarounds\nAny of the below actions can be taken to prevent the issue:\n- Validate input before calling `setLocale()`, for instance by forbidding or removing `/` and `\\`\n- Call `setLocale()` only with a locale from a whitelist of supported locales\n- When uploading files, rename them so they cannot have a `.php` extension (this is recommended even if you're not affected by this issue)\n- Prefer storage system that are not local to the application (remote service, or local service ran by another user so the uploaded files actually live outside of the application basedir)\n\n### References\nhttps://en.wikipedia.org/wiki/File_inclusion_vulnerability\n\n### Credits\nThanks to **Szczepan Hołyszewski** who reported the issue and to Tidelift to coordinate the resolution","published":"2025-01-08T20:40:37.545Z","modified":"2026-10-28T02:31:09.752863018Z","cvss":null,"epss":{"score":0.00723,"percentile":0.52353,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"nesbot/carbon","fixedVersion":"3.8.4"},{"ecosystem":"Packagist","name":"nesbot/carbon","fixedVersion":"2.72.6"}],"fix":{"url":"https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58","label":"briannesbitt/Carbon@129700e"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00032.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22145.json"},{"type":"ADVISORY","url":"https://github.com/CarbonPHP/carbon/security/advisories/GHSA-j3f9-p6hm-5w6q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22145"},{"type":"FIX","url":"https://github.com/briannesbitt/Carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58"},{"type":"PACKAGE","url":"https://github.com/CarbonPHP/carbon"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:09.752863018Z"}}