Composer ezsystems/ezpublish-kernel has 17 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-10806 | eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type | critical | 9.8 | <5.4.14.1 or >=6.0 and <6.13.6.2 or >=7.0 and <7.5.6.2 | 5.4.14.1, 6.13.6.2, 7.5.6.2 |
| CVE-2022-25337 | Code injection in ezsystems/ezpublish-kernel | critical | 9.8 | >=7.5.0 and <7.5.26 | 7.5.26 |
| CVE-2022-48365 | Company admin role gives excessive privileges in eZ Platform Ibexa | high | 7.2 | >=7.5.0 and <7.5.30 | 7.5.30 |
| CVE-2022-48367 | Object state limitation has no effect | critical | 9.8 | >=7.5.0 and <7.5.28 | 7.5.28 |
| CVE-2021-46876 | /user/sessions endpoint allows detecting valid accounts | medium | 5.3 | >=6.13.0 and <6.13.8.1 or >=7.5.0 and <7.5.15.1 | 6.13.8.1, 7.5.15.1 |
| CVE-2022-48366 | Timing attack in eZ Platform Ibexa | low | 3.7 | >=7.5.0 and <7.5.29 | 7.5.29 |
| CVE-2021-46875 | Cross-site scripting in eZ Platform Kernel | high | 0.0 | <6.13.8.2 or >=7.0.0 and <7.5.15.2 | 6.13.8.2, 7.5.15.2 |
| 2018-11-21-1 | EZSA-2018-008 REST API returns list of all SiteAccesses | unknown | 0.0 | >=7.3.0 and <7.3.2.1 or >=7.0.0 and <7.2.4.1 or >=6.8.0 and <6.13.5.1 or >=6.0.0 and <6.7.9.1 or >=5.4.0 and <5.4.13.1 or >=5.3.0 and <5.3.12.1 | 7.3.2.1, 7.2.4.1, 6.13.5.1, 6.7.9.1 |
| 2020-03-03-1 | EZSA-2020-001 Remote code execution in file uploads | unknown | 0.0 | >=7.5.0 and <7.5.6.2 or >=6.13.0 and <6.13.6.2 or >=5.4.0 and <5.4.14.1 | 7.5.6.2, 6.13.6.2, 5.4.14.1 |
| 2020-05-20-1 | EZSA-2020-004 Object Injection in SiteAccessMatchListener | unknown | 0.0 | >=7.5.0 and <7.5.7.1 or >=6.13.0 and <6.13.6.3 or >=5.4.0 and <5.4.14.2 | 7.5.7.1, 6.13.6.3, 5.4.14.2 |
| GHSA-3vwr-jj4f-h98x | eZ Publish Remote code execution in file uploads | high | 0.0 | >=7.5.0 and <7.5.6.2 or >=6.13.0 and <6.13.6.2 or >=5.4.0 and <5.4.14.1 | 7.5.6.2, 6.13.6.2, 5.4.14.1 |
| GHSA-44m4-9cjp-j587 | IBX-1392: Image filenames sanitization | high | 0.0 | >=7.5.0 and <7.5.26 | 7.5.26 |
| GHSA-64vj-933f-6pm3 | eZ Platform Object Injection in SiteAccessMatchListener | high | 0.0 | >=7.5.0 and <7.5.8 or >=6.13.0 and <6.13.6.4 or >=5.4.0 and <5.4.15 | 7.5.8, 6.13.6.4, 5.4.15 |
| GHSA-946c-f9w6-2c25 | Download route allows filename change in eZpublish kernel | low | 0.0 | >=7.5.0 and <7.5.31 | 7.5.31 |
| GHSA-99r3-xmmq-7q7g | eZ Platform users with the Company admin role can assign any role to any user | critical | 0.0 | >=7.5.0 and <7.5.30 | 7.5.30 |
| GHSA-9wwx-c723-vm8x | eZ Platform REST API returns list of all SiteAccesses | medium | 0.0 | >=7.3.0 and <7.3.2.1 or >=7.0.0 and <7.2.4.1 or >=6.8.0 and <6.13.5.1 or >=6.0.0 and <6.7.9.1 or >=5.4.0 and <5.4.13.1 or >=5.3.0 and <5.3.12.1 | 7.3.2.1, 7.2.4.1, 6.13.5.1, 6.7.9.1 |
| GHSA-xfqg-p48g-hh94 | Login timing attack in ezsystems/ezpublish-kernel | critical | 0.0 | >=7.5.0 and <7.5.29 | 7.5.29 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked