-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves path traversal via the 'script' parameter in cobbler-web's profile service endpoint (/cblr/svc/profile/.../op/script). The function responsible for processing this parameter (likely named render_script or similar in web views) fails to properly validate() user input, allowing '../' sequences to escape the intended directory. This matches the described attack vector and CWE-79's context of improper input validation. Confidence is medium due to lack of direct code references, but the URL structure and vulnerability pattern strongly suggest this handler is involved.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cobbler | pip | <= 2.6.11-1 |