High
Security advisory
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-1000148
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:15 UTC · Revision 1
Source evidence
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file.
osv:CVE-2017-1000148
Complete source record
{
"id": "59203afcbe84c77a62b9be54c8acc2157c6ff75aa3b1712c8f5c73505537abbb",
"url": "https://osv.dev/vulnerability/CVE-2017-1000148",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-1000148",
"summary": "Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP \"unserialize()\" function when importing a skin from an XML file.",
"evidence": "osv:CVE-2017-1000148",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-1000148",
"aliases": [
"CVE-2017-1000148"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/maharaproject/mahara",
"type": "GIT",
"events": [
{
"introduced": "48a238a2f76a7ea322580fe93b7c026becd9acce"
},
{
"last_affected": "1c2f89f8ee9dd8dba44594e8d50a4d47380eec9e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04-rc1"
},
{
"last_affected": "15.04-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04-rc2"
},
{
"last_affected": "15.04-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.0"
},
{
"last_affected": "15.04.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.1"
},
{
"last_affected": "15.04.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.2"
},
{
"last_affected": "15.04.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.3"
},
{
"last_affected": "15.04.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.4"
},
{
"last_affected": "15.04.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.5"
},
{
"last_affected": "15.04.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.6"
},
{
"last_affected": "15.04.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.7"
},
{
"last_affected": "15.04.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04-rc1"
},
{
"last_affected": "16.04-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04-rc2"
},
{
"last_affected": "16.04-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04.0"
},
{
"last_affected": "16.04.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04.1"
},
{
"last_affected": "16.04.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.0"
},
{
"last_affected": "15.10.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.1"
},
{
"last_affected": "15.10.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.2"
},
{
"last_affected": "15.10.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.3"
},
{
"last_affected": "15.10.3"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"15.04-rc1",
"15.04-rc2",
"15.04.0",
"15.04.1",
"15.04.2",
"15.04.3",
"15.04.4",
"15.04.5",
"15.04.6",
"15.04.7",
"15.10.0",
"15.10.1",
"15.10.2",
"15.10.3",
"16.04-rc1",
"16.04-rc2",
"16.04.0",
"16.04.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000148.json"
}
}
],
"modified": "2026-10-24T10:30:37.496735192Z",
"provider": "osv",
"references": [
"https://bugs.launchpad.net/mahara/+bug/1508684"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-1000148",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 434233,
"published_at": "2017-11-03T18:29:00.84+00:00"
}