SS-2026-003 - RCE via renamed uploaded file

PKSA-gm8m-6kzj-72zw

Affected version: <2.4.6|>=3.0.0,<3.2.4

Reported by:
FriendsOfPHP/security-advisories

[MEDIUM] CVE-2026-24749 - DBFile permission bypass

PKSA-tfnf-7k34-fpdv CVE-2026-24749 GHSA-jgcf-rf45-2f8v

Affected version: >=2.0.0,<2.4.5|>=3.0.0,<3.1.3

Reported by:
GitHub, FriendsOfPHP/security-advisories