Package	Affected Versions	Patched Versions	Severity
📦 nesbot/carbon (Composer)	>= 3.0.0, < 3.8.4	3.8.4	Moderate

Applications using Carbon::setLocale with unsanitized user input are vulnerable to arbitrary file inclusion. If users can upload .php files to directories the server can include or require, attackers could execute arbitrary PHP code on the server.

Upgrade nesbot/carbon to one of the patched versions:

• Version 3.8.4 (for 3.x users)


• Version 2.72.6 (for 2.x users)

Workarounds

If you cannot upgrade immediately, apply these steps to mitigate the risk:

1. Validate Input for setLocale()
   
   
   
   • Ensure user-provided input is sanitized.
   
   
   • Strip or disallow special characters like / and \.
   
   
   
   Example:
   
   
   

   $locale = preg_replace('/[\/\\\\]/', '', $userInput);
Carbon::setLocale($locale);


   
   


2. Use a Whitelist for Locales
   
   
   
   • Restrict setLocale() to known, safe values.
   
   
   • Example:
     
     
     

     $allowedLocales = ['en', 'fr', 'de']; // Define supported locales
if (in_array($userInput, $allowedLocales)) {
Carbon::setLocale($userInput);
}


     
     
   
   
   
   


3. Secure File Uploads
   
   
   
   • Rename uploaded files to remove .php extensions.
   
   
   • Store uploads in directories outside the application’s base directory.
   
   
   
   Example:
   
   
   

   $fileExtension = pathinfo($uploadedFile['name'], PATHINFO_EXTENSION);
$newFileName = uniqid() . '.' . $fileExtension;
move_uploaded_file($uploadedFile['tmp_name'], '/secure/path/' . $newFileName);


   
   


4. Use External Storage
   
   
   
   • Store uploaded files in services or directories not accessible by the main application (e.g., cloud storage or a separate server).
   
   
   
   

---

Practical Advice

If you’re already questioning why the locale needs to be dynamic in the first place, join the club! Sticking to a known list of locales not only patches this issue but might also save you a debugging session later.