-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.gravitee.apim:gravitee-api-management | maven | < 1.25.3 | 1.25.3 |
Miggo AIRoot Cause AnalysisThe vulnerability combines HTML injection in user registration fields with improper path handling in email processing. The EmailService's resource embedding logic uses unsanitized user-controlled input (from <img src> attributes) to create FileSystemResource objects. This allows path traversal sequences like '../../../../etc/passwd' to be processed, as confirmed by the Medium article's analysis. The function is vulnerable because it: 1) Processes untrusted HTML input, 2) Fails to validate/sanitize file paths, 3) Directly uses user-controlled values in file system operations.
JavaJavaOngoing coverage of React2Shell