Minify arbitrary file disclosure

Description

On some systems running Minify, an attacker may be able to reveal the contents of arbitrary files. You are strongly advised to follow the instructions below to manually patch your system, and upgrade to Minify 2.1.7 when possible.

On some PHP systems, file system functions accept parameters containing null bytes ("\x00"), but do not handle them correctly. An attacker may be able to use Minify to reveal the contents of any file PHP has access to within the document root, including sensitive configuration files.

Remediation

Upgrade to the latest version of Minify.

References
Severity
Classification
Tags
  • Information Disclosure