-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 1.9.0, < 1.9.4 | 1.9.4 |
| moodle/moodle | composer | >= 1.8.0, < 1.8.8 | 1.8.8 |
| moodle/moodle | composer | >= 1.7.0, < 1.7.7 | 1.7.7 |
| moodle/moodle | composer | >= 1.6.0, < 1.6.9 | 1.6.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure temporary file handling in spell-check-logic.cgi. The script writes to /tmp/spell-check-debug.log, /tmp/spell-check-before, and /tmp/spell-check-after without using safe file creation methods (e.g., O_EXCL flag, randomized filenames, or proper symlink checks). This matches the CWE-59 pattern of improper link resolution before file access. Though the exact code isn't available, the advisory explicitly identifies this script as the vulnerable component, and the attack pattern aligns with unsafe file operations in CGI scripts handling temporary files.
Ongoing coverage of React2Shell