CVE-2024-34515: Spatie Image Optimizer

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

image-optimizer before 1.7.3 allows PHAR deserialization, e.g., the phar:// protocol in arguments to file_exists().

Affected products

• Spatie Image Optimizer: up to and including 1.7.3

Published 2024-05-05. Last modified 2026-06-17.