-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/intl | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/intl | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/intl | composer | >= 3.0.0, < 3.2.14 | 3.2.14 |
| symfony/intl | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
| symfony/symfony | composer | >= 2.7.0, < 2.7.38 | 2.7.38 |
| symfony/symfony | composer | >= 2.8.0, < 2.8.31 | 2.8.31 |
| symfony/symfony | composer | >= 3.0.0, < 3.2.14 | 3.2.14 |
| symfony/symfony | composer | >= 3.3.0, < 3.3.13 | 3.3.13 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from read() methods in bundle readers that concatenate paths with user-controlled locale parameters. The Symfony blog post and CVE description explicitly mention these methods as the attack vector, and the patch (PR #24994) adds path validation to prevent directory traversal. The affected classes are part of Symfony's Intl component's resource bundle handling, consistent with the vulnerability's context.