-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly states unrestricted file uploads due to missing file type validation. In TYPO3 Extbase extensions, file upload handling typically occurs in controller actions. The EventController is the most logical component for handling event-related submissions, including file attachments. The critical impact (RCE/DoS) strongly suggests the vulnerable code resides in the core upload processing logic, which would be implemented in a controller action like uploadAction. While the exact function name isn't confirmed in public sources, the pattern matches TYPO3 Extbase conventions and the described vulnerability mechanism.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| slub/slub-events | composer | < 3.0.3 | 3.0.3 |
Ongoing coverage of React2Shell