CVE-2020–15227: Potential Remote Code Execution Vulnerability
For the first time in Nette's 13-year history, a security flaw was
discovered in it. It was found by a developer from picturesque Taiwan. This is a
serious vulnerability that can, under certain circumstances, lead to remote code
The vulnerability allows an attacker to execute PHP code on some websites
under certain circumstances using a specially formed URL. We will not publish a
detailed description of the attack mechanism.
A fix is available for all affected versions of Nette, ie starting from
version 2.0. Although it has not been maintained for over 6 years, Nette pays
particular attention to safety, that is why patches for unsupported versions
have been released.
Please update as soon as possible to the latest patch version:
- nette/application 3.0.6 (or 18.104.22.168, 3.1.0-RC2 or dev)
- nette/application 2.4.16
- nette/application 2.3.14
- nette/application 2.2.10
- nette/nette 2.1.13
- nette/nette 2.0.19
We would like to thank Cyku Hong from DEVCORE
for discovering and reporting the vulnerability.
All Nette partners were immediately notified of the issue via email so they
had sufficient time to patch sites before the information went public.
Update Using Composer
Usually it is enough to call
composer update in the project and
the current versions of all packages will be downloaded. To update only a
specific package, use eg
composer update nette/application.
You can find out which version of each package you have installed using
composer show command.
Note: Composer needs to be run with the same version of PHP as is used on
hosting, or add a version constrain to composer.json, see
Update by Downloading the
If you use distribution packages instead of Composer, you can download them from the archive.
Michal Špaček wrote a Linux
script, which automatically applies the patch directly to the Nette source
code on disk. It is useful if you maintain a large number of projects that you
do not have the time to update correctly using Composer.