-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the unescaped error message output in the run() method. The commit diff shows the fix adds Html::encode() to sanitize the error message. Since this method handles user-controlled file upload errors and directly returns the unescaped value in JSON responses, it creates an XSS vector when the error message is rendered in the browser. The patch confirmation and CWE-79 classification confirm this is an XSS vulnerability caused by improper output encoding in this function.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vova07/yii2-fileapi-widget | composer | < 0.1.9 | 0.1.9 |
Ongoing coverage of React2Shell