Open-source package vulnerability · Composer (PHP)
CVE-2025-32931: DevDojo Voyager Argument Injection vulnerability
criticalCVSS 3.1 9.1GHSA-qq2h-m2hj-hrff
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.
Published Apr 14, 2025
Affected packages
tcg/voyager
- Ecosystem
- Composer (PHP)
- Affected
- >= 1.4.0, <= 1.8.0
- Fixed in
- No patched version yet
- Check
composer show tcg/voyager
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-32931
- https://github.com/lishihihi/voyager-issue-report
- https://github.com/thedevdojo/voyager/blob/1.8/docs/core-concepts/compass.md
- https://github.com/thedevdojo/voyager/blob/7e7e0f4f0e115d2d9e0481a86153a1ceff194c00/resources/views/compass/includes/commands.blade.php#L11-L16
- https://github.com/advisories/GHSA-qq2h-m2hj-hrff
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology