-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openid/php-openid | composer | < 2.3.0 | 2.3.0 |
| typo3/cms | composer | >= 6.2.0, < 6.2.6 | 6.2.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the setXML method in Auth/Yadis/XML.php, which processed untrusted XML input without proper XXE protections. The GitHub patch explicitly adds libxml_disable_entity_loader(true) and error handling around the loadXML call, confirming this was the vulnerable code path. The TYPO3/CMS package is listed as vulnerable due to its dependency on php-openid, but the root vulnerable function resides in the openid library's XML parser implementation.
A Semantic Attack on Google Gemini - Read the Latest Research