-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dompdf/dompdf | composer | >= 0.6, < 0.6.2 | 0.6.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from DOMPDF's PHP execution capability (DOMPDF_ENABLE_PHP) which used eval() in PHP_Evaluator::execute. The 0.6.2 release notes mention security fixes related to PHP preprocessing removal. The CWE-94 classification confirms code injection via eval(), and the RCE nature aligns with unrestricted PHP execution through document input. The PHP_Evaluator class is directly responsible for executing embedded PHP code, making it the clear vulnerable component when enabled.
PHPPHP