-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.2.0, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.3 | 2.3.3 |
Miggo AIRoot Cause AnalysisThe vulnerability involves improper handling of file extensions during Media Storage synchronization. The synchronization process (likely in Magento\MediaStorage components) fails to enforce strict file type checks, allowing JPEG-uploaded files to be stored as PHP. The functions responsible for initiating synchronization (controller) and writing files (synchronization service) are the most plausible candidates. Confidence is medium due to the lack of patch details, but the logic aligns with Magento's architecture and CWE-434 patterns.
Ongoing coverage of React2Shell