🐛 security: HIGH CVEs detected in Docker image dependencies (Alpine base + Composer packages)

[Romerolweb]

Summary

A Docker Scout scan of the production backend image (dunglas/frankenphp:php8.3-alpine / Alpine 3.23 base) surfaced 26 HIGH CVEs across 8 packages. These vulnerabilities are not introduced by any recent contribution — they exist in the upstream Alpine 3.23 base packages and the current composer.lock dependencies.

This issue documents the findings so they can be tracked and addressed upstream or by a maintainer with access to the relevant packages.

Scan tool: Docker Scout (docker scout cves)
Image scanned: production backend and all-in-one images
Severity filter: HIGH + CRITICAL only (0 CRITICAL found)

---

Group 1 — Alpine base packages (no fix available in Alpine 3.23)

These CVEs have no patched version published yet for Alpine 3.23 at the time of scanning. Nothing actionable for now — monitoring recommended.

imagemagick 7.1.2.17-r0 — 13 HIGH CVEs

CVE	Scout link
CVE-2025-55154	https://scout.docker.com/v/CVE-2025-55154
CVE-2025-55298	https://scout.docker.com/v/CVE-2025-55298
CVE-2025-55004	https://scout.docker.com/v/CVE-2025-55004
CVE-2025-57803	https://scout.docker.com/v/CVE-2025-57803
CVE-2025-53015	https://scout.docker.com/v/CVE-2025-53015
CVE-2025-53101	https://scout.docker.com/v/CVE-2025-53101
CVE-2026-28693	https://scout.docker.com/v/CVE-2026-28693
CVE-2026-23876	https://scout.docker.com/v/CVE-2026-23876
CVE-2024-41817	https://scout.docker.com/v/CVE-2024-41817
CVE-2014-9831	https://scout.docker.com/v/CVE-2014-9831
CVE-2014-9830	https://scout.docker.com/v/CVE-2014-9830
CVE-2014-9828	https://scout.docker.com/v/CVE-2014-9828
CVE-2014-9827	https://scout.docker.com/v/CVE-2014-9827

Note: ImageMagick is used for image/PDF processing. If it is not strictly required, replacing it with a lighter alternative (e.g. libvips) or removing it from the base image would eliminate all 13 CVEs.

---

tar 1.35-r4 — 6 HIGH CVEs

CVE	Scout link
CVE-2026-31802	https://scout.docker.com/v/CVE-2026-31802
CVE-2026-29786	https://scout.docker.com/v/CVE-2026-29786
CVE-2026-26960	https://scout.docker.com/v/CVE-2026-26960
CVE-2026-24842	https://scout.docker.com/v/CVE-2026-24842
CVE-2026-23745	https://scout.docker.com/v/CVE-2026-23745
CVE-2018-20834	https://scout.docker.com/v/CVE-2018-20834

---

nghttp2 1.68.0-r0 — 1 HIGH CVE

CVE	Scout link
CVE-2026-27135	https://scout.docker.com/v/CVE-2026-27135

---

libde265 1.0.16-r0 — 1 HIGH CVE

CVE	Scout link
CVE-2026-33164	https://scout.docker.com/v/CVE-2026-33164

---

curl 8.17.0-r1 — 1 HIGH CVE

CVE	Scout link
CVE-2026-3805	https://scout.docker.com/v/CVE-2026-3805

---

Group 2 — Alpine base packages (fix available)

These CVEs have a patched version in Alpine. They can be resolved by adding RUN apk upgrade --no-cache openssl to the Dockerfiles, or by waiting for the base image to bump its lockfile.

openssl 3.5.5-r0 — 2 HIGH CVEs — ✅ fixed in 3.5.6-r0

CVE	Fixed version	Scout link
CVE-2026-31790	3.5.6-r0	https://scout.docker.com/v/CVE-2026-31790
CVE-2026-2673	3.5.6-r0	https://scout.docker.com/v/CVE-2026-2673

Suggested fix in Dockerfiles:

RUN apk upgrade --no-cache openssl

---

Group 3 — Composer dependencies (fix available)

These are application-level PHP dependencies tracked in composer.lock. They are not introduced by any infrastructure change and are within the project's direct control.

aws/aws-sdk-php 3.356.40 — 1 HIGH — ✅ fixed in 3.371.4

Advisory	Fixed version	Scout link
GHSA-27qh-8cxx-2cr5	3.371.4	https://scout.docker.com/v/GHSA-27qh-8cxx-2cr5

Suggested fix:

composer require aws/aws-sdk-php:^3.371.4

---

symfony/http-foundation 7.3.4 — 1 HIGH — ✅ fixed in 7.3.7

CVE	Fixed version	Scout link
CVE-2025-64500	7.3.7	https://scout.docker.com/v/CVE-2025-64500

Suggested fix:

composer update symfony/http-foundation

This package is typically pulled in transitively by Laravel. Updating it in composer.json constraints or running composer update should be sufficient.

---

Summary table

Package	Severity	Count	Fix available?
imagemagick 7.1.2.17-r0	HIGH	13	❌ No fix in Alpine 3.23
tar 1.35-r4	HIGH	6	❌ No fix in Alpine 3.23
openssl 3.5.5-r0	HIGH	2	✅ Upgrade to 3.5.6-r0
nghttp2 1.68.0-r0	HIGH	1	❌ No fix in Alpine 3.23
libde265 1.0.16-r0	HIGH	1	❌ No fix in Alpine 3.23
curl 8.17.0-r1	HIGH	1	❌ No fix in Alpine 3.23
aws/aws-sdk-php 3.356.40	HIGH	1	✅ Upgrade to 3.371.4
symfony/http-foundation 7.3.4	HIGH	1	✅ Upgrade to 7.3.7

Total: 26 HIGH, 0 CRITICAL

---

How this was discovered

Scanned using Docker Scout after running the FrankenPHP migration PR (#1154).
The same vulnerabilities are present on the current develop branch images (they originate from the Alpine base and existing composer.lock, not from the PR).

docker scout cves <image> --only-severity critical,high