- 🇬🇧United Kingdom mcdruid 🇬🇧🇪🇺
There's an issue about a 7.x-1.6 release 📌 Issues to fix as part of next stable release (7.x-1.6) Fixed .
The presence of
create_function()in the current release could be exploited to gain Remote Code Execution although the conditions for this to happen are pretty extreme / unlikely. It could represent part of a chained attack though.I filed a private security issues about this a long time ago and it was agreed that the discussion could take place in public.
I won't put the exact details here just yet as the "vulnerable" code is still in the latest supported release.