GHSA-c2p2-hgjg-9r3f: Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header

critical Affects islandora/crayfish. Feed 2026.10.29.1, updated 2026-10-28; published 2025-02-12.

Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header

Package: islandora/crayfish Composer
Affected versions: <=4.0.0
Fixed in: no fix recorded
Severity: critical
Exploitation: not on CISA KEV
Published: 2025-02-12
Source: osv.dev

References

NVD record islandora/crayfish advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2025-25286 critical Crayfish allows Remote Code Execution via Homarus Authorization header same package: islandora/crayfish
CVE-2026-102601 low Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is b same weakness: CWE-150
GHSA-27qh-8cxx-2cr5 high AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters same weakness: CWE-150
CVE-2013-2010 critical WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability same weakness: CWE-74
CVE-2020-9757 critical SEOmatic for CraftCMS allows Server-Side Template Injection same weakness: CWE-74
CVE-2024-50340 high Symfony allows changing the environment through a query same weakness: CWE-74