-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.6.8 | 2.6.8 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.5 | 2.7.5 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.3 | 2.8.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems directly from the min_get_slash_argument function in lib/configonlylib.php. The pre-patch code returned $_GET['file'] or PATH_INFO values without sanitization when certain server conditions were met. The GitHub patch explicitly adds min_clean_param with SAFEPATH to sanitize outputs, confirming the original lack of validation. The CVE description and commit message both directly implicate this function as the source of insufficient path traversal protections.