-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key flaws: 1) The system allows upload of .jpg files containing PHP code (insufficient content validation), and 2) The replacement mechanism permits changing extensions to .php without proper checks. The AssetsController's file replacement handler and Assets service's file replacement logic would be the primary locations where filename validation should occur but was missing. These components likely use PHP's rename() or move_uploaded_file() functions with user-controlled filenames without adequate extension whitelisting, enabling the extension change attack vector described in the CVE.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | <= 2.6.3000 |