Repository navigation

Security

Report a vulnerability

.github/SECURITY.md

Security Policy

PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY.

Reporting a Vulnerability

If you discover a security vulnerability within NativePHP for Mobile, please send an email to support@nativephp.com or use GitHub's Report a vulnerability.

All security vulnerabilities will be promptly addressed.

Path traversal in the /_assets static asset handler
GHSA-76px-r497-93p9 published Oct 25, 2026 by simonhamp

Moderate
File.Move and File.Copy accept unrestricted filesystem paths
GHSA-3w4w-cchh-qvrw published Oct 25, 2026 by simonhamp

High
Arbitrary object instantiation via the /_native/api/events endpoint
GHSA-83jv-8h7x-287p published Oct 25, 2026 by simonhamp

High
Web view pages can drive the async task bridge, leading to code injection
GHSA-9884-fw9c-mq85 published Oct 25, 2026 by simonhamp

High
Async task payloads are deserialized without authentication
GHSA-9g37-88p8-75j2 published Oct 25, 2026 by simonhamp

High
Android runtime logs Laravel session and XSRF cookies to logcat in release builds
GHSA-27jx-7m9x-fx5c published Oct 25, 2026 by simonhamp

Moderate

Learn more about advisories related to NativePHP/mobile-air in the GitHub Advisory Database