-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper sanitization of the 'support/output' path configuration value. The primary entry point is the admin configuration save controller (ConfigController::saveAction), which processes user input. The lack of validation allows crafted paths to be stored via Mage_Core_Model_Config_Data::save. These paths are then likely used in file operations (e.g., log generation, template rendering) where PHP code execution occurs. While the exact code execution vector isn't visible without patch details, the high-privilege configuration handling functions are the logical points of failure for CWE-94.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/core | composer | < 1.9.4.3 | 1.9.4.3 |