Security Issue

[altm4n]

In Mustache.php v2.14.0 and before, Sections tag can lead to arbitrary php code execution when section value is controllable.

[bobthecow]

Are you referring to this? https://github.com/bobthecow/mustache.php/wiki/Callable

[altm4n]

No,This attack is also work even if strict_callables is true.

…

------------------ 原始邮件 ------------------ 发件人: "bobthecow/mustache.php" ***@***.***>; 发送时间: 2022年1月19日(星期三) 中午11:35 ***@***.***>; 抄送: " ***@***.***>;"State ***@***.***>; 主题: Re: [bobthecow/mustache.php] Security Issue (Issue #388) Are you referring to this? https://github.com/bobthecow/mustache.php/wiki/Callable — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you modified the open/close state.Message ID: ***@***.***>