-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability involves bypassing file upload protections via form data injection. Magento's admin file upload controllers (e.g., product gallery, downloadable files) are primary targets because they handle user-uploaded content. These functions likely relied on client-supplied parameters to define validation rules (e.g., allowed file types), which attackers could manipulate to include 'php' extensions. The CWE-94 (Code Injection) alignment and the described attack vector strongly suggest these functions as the entry points for the exploit.