-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how the task v2 API's import_image function handled image metadata. The original code called set_image_data on the 'original_image' object before saving location details, leading to missing location entries. The patch moved set_image_data to operate on a freshly retrieved 'new_image' object from the database, ensuring location metadata is persisted. This directly correlates with the described vulnerability where deleted task-created images left residual data due to missing location tracking.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| glance | pip | < 11.0.0a0 | 11.0.0a0 |