-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisBoth functions use StringUtils.ReplaceIgnoreCase to remove 'as' substrings from filenames without proper validation. This allows crafted extensions like '.aassp' to become '.asp' after processing. The GitHub issue explicitly references these functions, and the patch (changing to PathUtils.GetSafeFilename) confirms the vulnerability. The CWE-434 mapping further supports the unsafe file upload mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sscms | nuget | < 6.12 | 6.12 |
A Semantic Attack on Google Gemini - Read the Latest Research