oro/platform

Main OroPlatform package with core functionality.

View on Packagist

View on Github

Activity

Latest release: 2mo ago
Total releases: 330
Cadence: ~22 days
Last 12 months: 12

Reach

Stars: 642

Details

License: MIT
First release: Jun 03, 2013

Releases

Version	Released
`7.0.4` patch	Aug 02, 2026
`6.1.11` patch	Jul 30, 2026
`6.1.10` patch	Jun 11, 2026
`7.0.3` patch	Jun 10, 2026
`7.0.2` patch	May 21, 2026
`7.0.1` patch	Apr 21, 2026
`6.1.9` patch	Apr 09, 2026
`7.0.0` major	Mar 31, 2026
`6.1.8` patch	Mar 20, 2026
`7.0.0-rc` pre	Jan 20, 2026
`6.1.7` patch	Jan 16, 2026
`6.0.10` patch	Nov 07, 2025
`6.1.6` patch	Oct 16, 2025
`6.1.5` patch	Sep 14, 2025
`6.1.5-rc1` pre	Sep 07, 2025
`6.1.4` patch	Jul 14, 2025
`6.1.3` patch	Jul 08, 2025
`6.0.9` patch	Jun 26, 2025
`6.1.2` patch	Jun 20, 2025
`6.1.1` patch	Apr 17, 2025
`6.1.0` minor	Mar 31, 2025
`6.0.8` patch	Feb 20, 2025
`6.1.0-rc.3` pre	Feb 17, 2025
`6.1.0-rc.2` pre	Feb 10, 2025
`6.0.7` patch	Feb 10, 2025
`6.1.0-rc` pre	Jan 31, 2025
`6.0.6` patch	Nov 25, 2024
`6.0.5` patch	Oct 22, 2024
`6.0.4` patch	Aug 19, 2024
`6.0.3` patch	Aug 09, 2024
`5.1.8` patch	Jul 01, 2024
`6.0.2` patch	Jul 01, 2024
`6.0.1` patch	May 07, 2024
`5.1.7` patch	May 07, 2024
`6.0.0` major	Mar 30, 2024
`6.0.0-rc` pre	Feb 29, 2024
`5.1.6` patch	Feb 19, 2024
`5.1.5` patch	Jan 15, 2024
`6.0.0-beta.1` pre	Jan 08, 2024
`5.1.4` patch	Dec 06, 2023
`5.1.3` patch 1 CVE	Nov 01, 2023
`5.1.2` patch 1 CVE	Sep 06, 2023
`5.1.1` patch 1 CVE	Jun 20, 2023
`5.0.12` patch 1 CVE	May 22, 2023
`5.1.0` minor 1 CVE	Mar 31, 2023
`5.0.11` patch 1 CVE	Mar 16, 2023
`5.1.0-rc.2` pre	Mar 03, 2023
`5.0.10` patch 1 CVE	Feb 03, 2023
`5.1.0-rc.1` pre	Feb 01, 2023
`5.0.9` patch 1 CVE	Dec 01, 2022

1–50 of 330

Repository

oroinc/platform

Forks: 340
Open issues: 221
Language: PHP
: 4.7/ 10

oroplatform
b2b
symfony
php

Dependencies (105)

Depends on

7.0.4

Used by

101

Supply-chain exposure

101 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (6)

GHSA-3vhm-q4w3-rw8q May 20, 2024

OroPlatform Forced Redirect to External Website

6.1 / 10
Medium
Network Low None Required Changed Low Low None

OroPlatform is prone to open redirection which could allow attackers to redirect users to external website.

Affected versions

1.7.01.7.11.7.21.7.3

Fixed in

1.7.4

References

https://github.com/oroinc/platform/commit/baf79ad4f6b32bd2834b1766745afb20a5ef4739
https://github.com/FriendsOfPHP/security-advisories/blob/master/oro/platform/2015-07-08.yaml
https://github.com/oroinc/platform
https://oroinc.com/orocrm/blog/orocrm-security-announcement

Updated Dec 05, 2024 · Source: OSV.dev
CVE-2023-45824 GHSA-vxq2-p937-3px3 Mar 25, 2024

Pinned entity creation form shows wrong data

4.3 / 10
Medium
Network Low Low None Unchanged Low None None

Impact

Logged in user can access page state data of pinned pages of other users by pageId hash.

Patch

--- src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php +++ src/Oro/Bundle/NavigationBundle/Controller/Api/PagestateController.php @@ -158,6 +158,13 @@ AbstractPageState::generateHash($this->get('request_stack')->getCurrentRequest()->get('pageId')) ); + if ($entity) { + $entity = $this->getEntity($entity->getId()); + } + if (!$entity) { + return $this->handleNotFound(); + } + return $this->handleView($this->view($this->getState($entity), Response::HTTP_OK)); }

Affected versions

5.1.05.1.15.1.25.1.35.0.05.0.15.0.105.0.115.0.125.0.25.0.35.0.4

+ 16 more Show less

5.0.55.0.65.0.75.0.85.0.94.2.04.2.14.2.104.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.9

Fixed in

5.1.4

References

https://github.com/oroinc/platform/security/advisories/GHSA-vxq2-p937-3px3
https://nvd.nist.gov/vuln/detail/CVE-2023-45824
https://github.com/oroinc/platform/commit/cf94df7595afca052796e26b299d2ce031e289cd
https://github.com/oroinc/platform

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2022-41951 GHSA-9v3j-4j64-p937 Nov 27, 2023

OroPlatform vulnerable to path traversal during temporary file manipulations

8.5 / 10
High
Network High Low None Changed High High High

Impact

Path Traversal is possible in Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName. With this method, an attacker can pass the path to a non-existent file, which will allow writing the content to a new file that will be available during script execution. The file will be deleted immediately after the script ends.

Workarounds

Apply patch

--- a/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php +++ b/vendor/oro/platform/src/Oro/Bundle/GaufretteBundle/FileManager.php @@ -614,6 +614,10 @@ */ public function getTemporaryFileName(string $suggestedFileName = null): string { + if ($suggestedFileName) { + $suggestedFileName = basename($suggestedFileName); + } + $tmpDir = ini_get('upload_tmp_dir'); if (!$tmpDir || !is_dir($tmpDir) || !is_writable($tmpDir)) { $tmpDir = sys_get_temp_dir();

Or decorate Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName in your customization and clear $suggestedFileName argument

public function getTemporaryFileName(string $suggestedFileName = null): string { if ($suggestedFileName) { $suggestedFileName = basename($suggestedFileName); } return parent::getTemporaryFileName($suggestedFileName); }

References

Path Traversal

How to Decorate Services

Affected versions

4.1.04.1.14.1.1-rc4.1.1-rc24.1.104.1.114.1.124.1.134.1.24.1.34.1.44.1.5

+ 23 more Show less

4.1.64.1.74.1.84.1.94.2.04.2.14.2.104.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.95.0.05.0.15.0.25.0.35.0.45.0.55.0.65.0.7

Fixed in

5.0.8

References

https://github.com/oroinc/platform/security/advisories/GHSA-9v3j-4j64-p937
https://nvd.nist.gov/vuln/detail/CVE-2022-41951
https://github.com/oroinc/platform

Updated Feb 16, 2024 · Source: OSV.dev
GHSA-rrgw-3hg3-9x8c Jan 12, 2022

XSS vulnerability in translations

6.9 / 10
Medium
Network Low High Required Changed High Low None

Summary

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:

Translation management UI.

Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.

Translations uploaded via Upload translation file on the All Languages grid

Workarounds

There are no workarounds that address this vulnerability.

Affected versions

3.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.19

+ 33 more Show less

3.1.23.1.203.1.33.1.43.1.53.1.63.1.73.1.83.1.94.1.04.1.14.1.1-rc4.1.1-rc24.1.104.1.114.1.124.1.134.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.04.2.14.2.24.2.34.2.44.2.54.2.64.2.7

Fixed in

3.1.294.1.174.2.8

References

https://github.com/oroinc/platform-er/security/advisories/GHSA-rrgw-3hg3-9x8c

Updated Dec 04, 2024 · Source: OSV.dev
CVE-2021-41236 GHSA-qv7g-j98v-8pp7 Jan 06, 2022

XSS vulnerability on email template preview page

6.9 / 10
Medium
Network Low High Required Changed High Low None

Summary

Email template preview is vulnerable to XSS payload added to email template content. The attacker should have permission to create or edit an email template. For successful payload, execution attacked user should preview a vulnerable email template.

Workarounds

There are no workarounds that address this vulnerability.

Affected versions

3.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.19

+ 33 more Show less

3.1.23.1.203.1.33.1.43.1.53.1.63.1.73.1.83.1.94.1.04.1.14.1.1-rc4.1.1-rc24.1.104.1.114.1.124.1.134.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.04.2.14.2.24.2.34.2.44.2.54.2.64.2.7

Fixed in

3.1.214.1.144.2.8

References

https://github.com/oroinc/platform/security/advisories/GHSA-qv7g-j98v-8pp7
https://nvd.nist.gov/vuln/detail/CVE-2021-41236
https://github.com/oroinc/platform/commit/2a089c971fc70bc63baf8770d29ee515ce5a415a
https://github.com/oroinc/platform

Updated Jul 08, 2026 · Source: OSV.dev
CVE-2021-43852 GHSA-jx5q-g37m-h5hj Jan 06, 2022

Client-Side JavaScript Prototype Pollution in oro/platform

5.3 / 10
Medium
Network Low None None Unchanged None Low None

Summary

By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution.

Workarounds

Configure WAF to drop requests containing next strings: __proto__ , constructor[prototype], constructor.prototype

Affected versions

4.1.04.1.14.1.1-rc4.1.1-rc24.1.104.1.114.1.124.1.134.1.24.1.34.1.44.1.5

+ 12 more Show less

4.1.64.1.74.1.84.1.94.2.04.2.14.2.24.2.34.2.44.2.54.2.64.2.7

Fixed in

4.1.144.2.8

References

https://github.com/oroinc/platform/security/advisories/GHSA-jx5q-g37m-h5hj
https://nvd.nist.gov/vuln/detail/CVE-2021-43852
https://github.com/oroinc/platform/commit/62c26936b3adee9c20255dcd9f8ee5c299b464a9
https://github.com/oroinc/platform

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 6
minor 21
patch 241
pre 61

330 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More