CVE-2025-22145 | CarbonPHP carbon up to 2.72.5/3.8.3 Carbon::setLocale filename control

A vulnerability, which was classified as critical, has been found in CarbonPHP carbon up to 2.72.5/3.8.3. Affected by this issue is the function Carbon::setLocale. The manipulation leads to improper control of filename for include/require statement in php program (‘php remote file inclusion’).

This vulnerability is handled as CVE-2025-22145. The attack may be launched remotely. There is no exploit available.

It is recommended to upgrade the affected component.