CVE-2025-22145

What it actually does

Unsanitized user input passed to Carbon::setLocale enables path traversal that results in arbitrary .php file inclusion when the uploaded file resides in an include/require path, leading to remote code execution.

Why it matters to the business

Attackers can execute arbitrary code on servers running vulnerable Carbon versions, potentially compromising application data, user information, and hosting infrastructure with minimal prerequisites.

How an attack unfolds

An attacker uploads a malicious .php file to a writable directory that is reachable by include/require, then supplies a crafted locale string containing path traversal sequences to Carbon::setLocale, causing the application to include and execute the attacker-controlled file.

How to fix it

Upgrade briannesbitt/carbon to version 3.8.4 or 2.72.6. Validate that all calls to setLocale sanitize or whitelist locale input and restrict PHP file uploads to non-executable directories.

How to confirm the fix worked

Review source code for direct use of user input in Carbon::setLocale, confirm deployed version is 3.8.4+ or 2.72.6+, and test that crafted locale strings no longer result in file inclusion.

Typical attack path

1. Identify an endpoint that accepts a locale parameter and forwards it directly to Carbon::setLocale without sanitization.
2. Upload a file with .php extension containing malicious code to a directory that the web application can read via include or require.
3. Craft a locale value using ../ sequences to traverse to the uploaded file path.
4. Trigger the setLocale call so the malicious file is included and executed on the server.

How to detect it

Search web server and application logs for requests containing path traversal patterns in locale parameters, unexpected .php file includes, or error messages referencing Carbon locale handling; inspect uploaded file directories for recently added .php files.

• ../
• ..\
• Carbon::setLocale
• include.*\.php

What your security team should do

• Immediately upgrade all Carbon installations to 3.8.4 or 2.72.6.
• Audit application code for unsanitized locale parameters passed to Carbon.
• Enforce server-side validation that rejects path traversal sequences and restricts file upload directories.
• Monitor for unexpected file inclusions or PHP errors referencing locale values.