HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| ezyang/htmlpurifier(Packagist) | 0 | N/A | N/A |
CVSS Metrics
