[GHSA-rgg3-3wh7-w935] Unrestricted Upload of File with Dangerous Type in Zenario CMS

[nikpivkin]

Updates

• Affected products

Comments
The first patched version should be 9.0.55141, not 9.0.55143. Version 9.0.55143 does not exist, there is no such tag in the repository and no such version on Packagist.

The fix commit linked in the advisory is TribalSystems/Zenario@4566d8a. It is the commit of tag 9.0.55141, and tag 9.0.54156 does not contain it. The 9.0.55141 release notes, already linked in the advisory, describe the fix for HTML and SVG uploads: https://github.com/TribalSystems/Zenario/releases/tag/9.0.55141

The OSV export takes the fixed version from the first patched version, so version 9.0.55141 is reported as vulnerable even though it has the fix.

[Copilot]

Copilot review overview

🟢 Approval recommended

The corrected version matches the fix commit’s tag and corresponding security release.

Review effort: Balanced
Findings: None

What changed in this PR

Corrects the Zenario CMS advisory’s first patched version to prevent inaccurate OSV vulnerability reporting.

Changes:

• Changes the fixed version from nonexistent 9.0.55143 to verified release 9.0.55141.
• Updates the advisory modification timestamp.

File	Description
GHSA-rgg3-3wh7-w935.json	Corrects the affected-version range.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.