Vulnerability in Carbonphp Carbon
CVE-2025-22145
Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.
Published · last modified .
EPSS exploit prediction
EPSS: 0.007 (52.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 52nd percentile — 52.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Carbonphp Carbon — versions < 2.72.6, >= 3.0.0, < 3.8.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-22145?
- CVE-2025-22145 is a vulnerability in Carbonphp Carbon, classified under PHP Remote File Inclusion. Published 2025-01-08.
- Is CVE-2025-22145 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.