-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from inadequate file extension validation in Asset.php's filename sanitization logic. The commit 6ee5d85 shows the patch added 'phar' to the blocked extensions regex in the correctPath() method. This function's failure to rename .phar files to .txt allowed PHAR uploads, which when accessed via phar:// wrapper would trigger deserialization. The CWE-502 mapping confirms this is a deserialization vulnerability via untrusted PHAR files.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pimcore/pimcore | composer | < 5.7.1 | 5.7.1 |
Ongoing coverage of React2Shell