Launchpad.net

CVE 2022-33913

In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check.

CVE-2022-33913 (Candidate) is related to these bugs:

Bug #1978520: Only allow images to be served by thumb.php

		In	Importance	Status
1978520	Only allow images to be served by thumb.php	Mahara 22.04	Critical	Fix Released
1978520	Only allow images to be served by thumb.php	Mahara 22.10	Critical	Fix Released
1978520	Only allow images to be served by thumb.php	Mahara 21.10	Critical	Fix Released
1978520	Only allow images to be served by thumb.php	Mahara 21.04	Critical	Fix Released

See the

CVE page on Mitre.org for more details.