Vulnerability in Carbonphp Carbon
CVE-2025-22145
Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are at risk of arbitrary code ran on their servers. This vulnerability is fixed in 3.8.4 and 2.72.6.
EPSS: 0.007 (49.8th percentile) — read the EPSS interpretation.
Affected products
- Carbonphp Carbon — versions < 2.72.6, >= 3.0.0, < 3.8.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-22145?
- CVE-2025-22145 is a vulnerability in Carbonphp Carbon, classified under PHP Remote File Inclusion. Published 2025-01-08.
- Is CVE-2025-22145 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.