StackRadar

CVE-2025-22145

Medium

Advisory

Published 8 Jan 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
38
of 17,781 indexed, latest versions
Container images
34
deployed by those charts
Fix available
1 of 1
affected package

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale

Carried by container images the latest versions of 38 of 17,781 indexed charts deploy, on 34 images.

Affected packageAffected versionsFixed inImages
nesbot/carboncomposer1.30.0, 1.35.1, 1.39.1, 2.41.5+12 more2.72.634
OSV records
GHSA-j3f9-p6hm-5w6q

Charts affected

38 by stars
ChartLatestAffected imagesRadar Score
snipeitt3n3.4.11 of 2See more

snipeit t3n 3.4.1

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
snipe/snipe-it:v6.0.1455fb7636a98c
nesbot/carbon@2.59.1
2.72.6

Open the chart page →

18,509
invoiceninjainvoiceninjaVerified publisher0.10.21 of 5See more

invoiceninja invoiceninja 0.10.2

1 of the 5 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
invoiceninja/invoiceninja:5.6.241437916dee01
nesbot/carbon@2.68.1
2.72.6

Open the chart page →

2,709
dolibarrcowboysysopVerified publisher9.0.31 of 3See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
dolibarr/dolibarr:22.0.47ad88fc9b13c
nesbot/carbon@2.61.0
2.72.6

Open the chart page →

9,106
dolibarrhelmforgeVerified publisher1.2.181 of 3See more

dolibarr helmforge 1.2.18

1 of the 3 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
dolibarr/dolibarr:24.0.069ec52e3b7ef
nesbot/carbon@2.61.0
2.72.6

Open the chart page →

4,109
cachetdeliveryheroVerified publisher1.3.51 of 2See more

cachet deliveryhero 1.3.5

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
nesbot/carbon@1.30.0
2.72.6

Open the chart page →

1,896
laravelrenoki-co1.0.01 of 2See more

laravel renoki-co 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
nesbot/carbon@2.46.0
2.72.6

Open the chart page →

6,931
firefly-iiigeek-cookbookVerified publisher0.3.01 of 1See more

firefly-iii geek-cookbook 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
fireflyiii/core:version-5.6.142f4283bd0cf7
nesbot/carbon@2.56.0
2.72.6

Open the chart page →

2,076
monicageek-cookbookVerified publisher8.2.01 of 1See more

monica geek-cookbook 8.2.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
library/monica:3.7.0-apacheceb1ba4196ab
nesbot/carbon@2.56.0
2.72.6

Open the chart page →

2,096
webtreesgeek-cookbookVerified publisher2.2.01 of 1See more

webtrees geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.0.1969423a100fab
nesbot/carbon@2.54.0
2.72.6

Open the chart page →

3,646
leantimegissilabs1.3.01 of 2See more

leantime gissilabs 1.3.0

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
leantime/leantime:3.3.3ad4bfb0699d3
nesbot/carbon@2.72.5
2.72.6

Open the chart page →

6,416
librenmsmidokura-communityVerified publisher0.3.21 of 6See more

librenms midokura-community 0.3.2

1 of the 6 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
librenms/librenms:22.4.14f1f3d667cc7
nesbot/carbon@2.55.2
2.72.6

Open the chart page →

8,967
laravel-octanerenoki-co1.0.01 of 1See more

laravel-octane renoki-co 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
nesbot/carbon@2.46.0
2.72.6

Open the chart page →

3,634
cachetadnoctemVerified publisher0.3.31 of 2See more

cachet adnoctem 0.3.3

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
nesbot/carbon@1.30.0
2.72.6

Open the chart page →

1,896
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
n22107670/sample-app:0.4.08f3072db7aeb
nesbot/carbon@2.69.0
2.72.6

Open the chart page →

1,775
polrchristianhuthVerified publisher4.3.01 of 2See more

polr christianhuth 4.3.0

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ajanvier/polr:2.3.091ac61b88c85
nesbot/carbon@1.39.1
2.72.6

Open the chart page →

5,904
openldapcsic-charts0.1.11 of 2See more

openldap csic-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ldapaccountmanager/lam:8.0.1d46cf25d1dda
nesbot/carbon@2.55.2
2.72.6

Open the chart page →

5,293
heimdallegebackVerified publisher2.0.41 of 1See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.6.371597f4461e4
nesbot/carbon@2.72.3
2.72.6

Open the chart page →

1,664
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
nesbot/carbon@2.58.0
2.72.6

Open the chart page →

20,933
monicagabe565Verified publisher0.10.01 of 2See more

monica gabe565 0.10.0

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
library/monica:4.1.2-fpm-alpine6d1b2bd0947e
nesbot/carbon@2.72.3
2.72.6

Open the chart page →

1,173
anonaddygeek-cookbookVerified publisher6.0.01 of 1See more

anonaddy geek-cookbook 6.0.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
anonaddy/anonaddy:0.12.3957a95565166
nesbot/carbon@2.59.1
2.72.6

Open the chart page →

4,788
bookstackgeek-cookbookVerified publisher5.2.01 of 1See more

bookstack geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
nesbot/carbon@2.55.2
2.72.6

Open the chart page →

1,269
grocygeek-cookbookVerified publisher8.5.21 of 1See more

grocy geek-cookbook 8.5.2

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
linuxserver/grocy:version-v3.1.3291296e66c2a
nesbot/carbon@2.54.0
2.72.6

Open the chart page →

1,043
lycheegeek-cookbookVerified publisher6.4.21 of 1See more

lychee geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
lycheeorg/lychee-laravel:v4.3.0308c0e6231da
nesbot/carbon@2.46.0
2.72.6

Open the chart page →

601
cachethelm-charts-nr1.3.51 of 2See more

cachet helm-charts-nr 1.3.5

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
nesbot/carbon@1.30.0
2.72.6

Open the chart page →

1,896
sample-appkubeuest0.1.31 of 1See more

sample-app kubeuest 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
michaelepitech/sample-app:latestaf51d61c19f5
nesbot/carbon@2.69.0
2.72.6

Open the chart page →

1,427
freescoutl4gVerified publisher0.1.01 of 3See more

freescout l4g 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
tiredofit/freescout:php8.2-1.17.725b7cc0658f07
nesbot/carbon@1.35.1
2.72.6

Open the chart page →

5,332
laravel-chartlaravel-application0.2.01 of 1See more

laravel-chart laravel-application 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ibarreche/cloud-back-ci:lateste16a469c5791
nesbot/carbon@2.41.5
2.72.6

Open the chart page →

1,835
akauntingnas-helm-chartsVerified publisher1.0.31 of 2See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
akaunting/akaunting:3.0.1552811b36ec3a
nesbot/carbon@2.67.0
2.72.6

Open the chart page →

12,813
librenmsnimbolus0.5.11 of 3See more

librenms nimbolus 0.5.1

1 of the 3 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
librenms/librenms:24.11.00920bc9117a8
nesbot/carbon@2.72.5
2.72.6

Open the chart page →

2,293
openldapopenldap0.1.11 of 2See more

openldap openldap 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ldapaccountmanager/lam:8.0.1d46cf25d1dda
nesbot/carbon@2.55.2
2.72.6

Open the chart page →

5,293
firefly-iiiphntom0.2.101 of 2See more

firefly-iii phntom 0.2.10

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
nesbot/carbon@2.58.0
2.72.6

Open the chart page →

1,813
podcast-helmpodcastwala-helm0.1.01 of 2See more

podcast-helm podcastwala-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
shivani446/podcastwala-php:v1c0d07b7b4c8d
nesbot/carbon@1.39.1
2.72.6

Open the chart page →

621
laravel-workerrenoki-co1.1.01 of 1See more

laravel-worker renoki-co 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
nesbot/carbon@2.46.0
2.72.6

Open the chart page →

5,687
grocysarab97Verified publisher0.1.11 of 1See more

grocy sarab97 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
linuxserver/grocy:4.0.1f8f5f96b6ea8
nesbot/carbon@2.68.1
2.72.6

Open the chart page →

2,449
bookstackschmitzis0.1.11 of 1See more

bookstack schmitzis 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
solidnerd/bookstack:21.12762ffd5c51d3
nesbot/carbon@2.55.2
2.72.6

Open the chart page →

2,751
cachetsergiotocaliniVerified publisher1.0.01 of 1See more

cachet sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
cachethq/docker:2.3.15a61ff0f67ea7
nesbot/carbon@1.30.0
2.72.6

Open the chart page →

1,896
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
nesbot/carbon@2.58.0
2.72.6

Open the chart page →

2,019
mediawikiwbstack0.14.01 of 1See more

mediawiki wbstack 0.14.0

1 of the 1 container images this version deploys carry CVE-2025-22145.

Container imageDigestPackageFixed in
ghcr.io/wbstack/mediawiki:1.37-7.4-20220621-fp-beta-0c3012c8a34b4
nesbot/carbon@2.55.2
2.72.6

Open the chart page →

2,132

Container images carrying it

34 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
cachethq/docker:2.3.15a61ff0f67ea7
nesbot/carbon@1.30.0
2.72.6
4
ldapaccountmanager/lam:8.0.1d46cf25d1dda
nesbot/carbon@2.55.2
2.72.6
2
ajanvier/polr:2.3.091ac61b88c85
nesbot/carbon@1.39.1
2.72.6
1
akaunting/akaunting:3.0.1552811b36ec3a
nesbot/carbon@2.67.0
2.72.6
1
anonaddy/anonaddy:0.12.3957a95565166
nesbot/carbon@2.59.1
2.72.6
1
dolibarr/dolibarr:24.0.069ec52e3b7ef
nesbot/carbon@2.61.0
2.72.6
1
dolibarr/dolibarr:22.0.47ad88fc9b13c
nesbot/carbon@2.61.0
2.72.6
1
fireflyiii/core:version-5.6.142f4283bd0cf7
nesbot/carbon@2.56.0
2.72.6
1
ibarreche/cloud-back-ci:lateste16a469c5791
nesbot/carbon@2.41.5
2.72.6
1
invoiceninja/invoiceninja:5.6.241437916dee01
nesbot/carbon@2.68.1
2.72.6
1
leantime/leantime:3.3.3ad4bfb0699d3
nesbot/carbon@2.72.5
2.72.6
1
library/monica:4.1.2-fpm-alpine6d1b2bd0947e
nesbot/carbon@2.72.3
2.72.6
1
library/monica:3.7.0-apacheceb1ba4196ab
nesbot/carbon@2.56.0
2.72.6
1
librenms/librenms:24.11.00920bc9117a8
nesbot/carbon@2.72.5
2.72.6
1
librenms/librenms:22.4.14f1f3d667cc7
nesbot/carbon@2.55.2
2.72.6
1
linuxserver/grocy:version-v3.1.3291296e66c2a
nesbot/carbon@2.54.0
2.72.6
1
linuxserver/grocy:4.0.1f8f5f96b6ea8
nesbot/carbon@2.68.1
2.72.6
1
linuxserver/heimdall:2.6.371597f4461e4
nesbot/carbon@2.72.3
2.72.6
1
lycheeorg/lychee-laravel:v4.3.0308c0e6231da
nesbot/carbon@2.46.0
2.72.6
1
michaelepitech/sample-app:latestaf51d61c19f5
nesbot/carbon@2.69.0
2.72.6
1
n22107670/sample-app:0.4.08f3072db7aeb
nesbot/carbon@2.69.0
2.72.6
1
phntom/fireflyiii:version-5.7.5f881ea5fbbf1
nesbot/carbon@2.58.0
2.72.6
1
shivani446/podcastwala-php:v1c0d07b7b4c8d
nesbot/carbon@1.39.1
2.72.6
1
snipe/snipe-it:v6.0.1455fb7636a98c
nesbot/carbon@2.59.1
2.72.6
1
solidnerd/bookstack:21.12762ffd5c51d3
nesbot/carbon@2.55.2
2.72.6
1
tiredofit/freescout:php8.2-1.17.725b7cc0658f07
nesbot/carbon@1.35.1
2.72.6
1
ghcr.io/linuxserver/bookstack:version-v21.12f05447347ff1
nesbot/carbon@2.55.2
2.72.6
1
ghcr.io/nathanvaughn/webtrees:2.0.1969423a100fab
nesbot/carbon@2.54.0
2.72.6
1
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
nesbot/carbon@2.58.0
2.72.6
1
ghcr.io/wbstack/mediawiki:1.37-7.4-20220621-fp-beta-0c3012c8a34b4
nesbot/carbon@2.55.2
2.72.6
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
nesbot/carbon@2.58.0
2.72.6
1
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
nesbot/carbon@2.46.0
2.72.6
1
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
nesbot/carbon@2.46.0
2.72.6
1
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
nesbot/carbon@2.46.0
2.72.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.