-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/symfony | composer | >= 2.7.0, < 2.7.50 | 2.7.50 |
| symfony/symfony | composer | >= 2.8.0, < 2.8.49 | 2.8.49 |
| symfony/symfony | composer | >= 3.0.0, < 3.4.20 | 3.4.20 |
| symfony/symfony | composer | >= 4.0.0, < 4.0.15 | 4.0.15 |
| symfony/symfony | composer | >= 4.1.0, < 4.1.9 | 4.1.9 |
| symfony/symfony | composer | >= 4.2.0, < 4.2.1 | 4.2.1 |
| symfony/form | composer | >= 2.7.0, < 2.7.50 | 2.7.50 |
| symfony/form | composer | >= 2.8.0, < 2.8.49 | 2.8.49 |
| symfony/form | composer | >= 3.0.0, < 3.4.20 | 3.4.20 |
| symfony/form | composer | >= 4.0.0, < 4.0.15 | 4.0.15 |
| symfony/form | composer | >= 4.1.0, < 4.1.9 | 4.1.9 |
| symfony/form | composer | >= 4.2.0, < 4.2.1 | 4.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of file uploads in form fields not designed to accept files. The Form::submit method in vulnerable versions lacked the 'allow_file_upload' check shown in the patch (added via the transformationFailure logic). This allowed UploadedFile objects to reach setters expecting strings, triggering __toString() and path disclosure. The patch adds validation in this method to reject file uploads for non-file fields, confirming this as the vulnerable point.
A Semantic Attack on Google Gemini - Read the Latest Research