-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| drupal/core | composer | >= 7.0.0, < 7.65.0 | 7.65.0 |
| drupal/core | composer | >= 8.0.0, < 8.5.14 | 8.5.14 |
| drupal/core | composer | >= 8.6.0, < 8.6.13 | 8.6.13 |
| drupal/drupal | composer | >= 7.0.0, < 7.65.0 | 7.65.0 |
| drupal/drupal | composer | >= 8.0.0, < 8.5.14 | 8.5.14 |
| drupal/drupal | composer | >= 8.6.0, < 8.6.13 | 8.6.13 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from improper sanitization of filenames in AJAX responses during file uploads. In Drupal 8, FileWidget::formMultipleElements() builds the upload form elements and AJAX responses, where filenames were directly embedded without escaping. In Drupal 7, file_ajax_upload() similarly returned raw filenames in responses. Both cases allow XSS when a malicious filename containing JavaScript is rendered. Historical analysis of CVE-2019-6341 confirms these functions were patched by adding HTML escaping to filenames in these contexts.
Ongoing coverage of React2Shell