-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper file type handling in ImageMagick invocations. The original code in GraphicalFunctions.php used raw filenames with frame suffixes (e.g., 'file[0]') without explicit format specification ('png:file.png'). This allowed ImageMagick to perform type guessing based on file content, enabling execution of embedded PostScript code when GhostScript was present. The commit introduced ImageMagickFile to enforce format prefixes, directly addressing these insecure command constructions in imageMagickExec and imageMagickIdentify methods.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.0.0, < 8.7.25 | 8.7.25 |
| typo3/cms-core | composer | >= 9.0.0, < 9.5.6 | 9.5.6 |
| typo3/cms | composer | >= 8.0.0, < 8.7.25 | 8.7.25 |
| typo3/cms | composer | >= 9.0.0, < 9.5.6 | 9.5.6 |
Ongoing coverage of React2Shell