-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the dir() method in Surpass.php which handled user-controlled 'dir' parameter. The pre-patch code (line 53) directly assigned $this->_dir = $dir without sanitization. The patch adds str_replace to remove path traversal characters (/ and .), confirming this was the injection point. The CWE-22 classification and commit message explicitly reference directory traversal protection being added to this method.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sukohi/surpass | composer | < 1.0.0 | 1.0.0 |
Ongoing coverage of React2Shell