-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper path validation when setting the kickstart field in profiles. The commit diff shows the vulnerable code was in remote.py's modify_item function, which processed the 'kickstart' attribute for systems without path validation. The patch added validation specifically for this attribute, confirming this was the entry point. The CWE-22 classification and exploit PoC both align with this being the vulnerable function that accepted unvalidated user input for file paths.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cobbler | pip | >= 2.6.0, < 2.6.4 | 2.6.4 |
| cobbler | pip | >= 2.4.0, < 2.4.7 | 2.4.7 |
Ongoing coverage of React2Shell