-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing file extension validation during uploads. The security patches introduced blacklist checks in both Kernel (via YAML config) and Legacy (via INI setting). The vulnerable functions are the core file upload handlers that processed user-supplied files without these checks. FileStorage::uploadContents in Kernel and eZContentUpload::handleUpload in Legacy would appear in profilers during exploitation as they directly handle file upload operations. The confidence is high as the advisory explicitly links the vulnerability to missing extension validation in file upload mechanisms.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ezsystems/ezpublish-kernel | composer | < 5.4.14.1 | 5.4.14.1 |
| ezsystems/ezpublish-legacy | composer | < 5.4.14.1 | 5.4.14.1 |
| ezsystems/ezpublish-kernel | composer | >= 6.0, < 6.13.6.2 | 6.13.6.2 |
| ezsystems/ezpublish-kernel | composer | >= 7.0, < 7.5.6.2 | 7.5.6.2 |
| ezsystems/ezpublish-legacy | composer | >= 2017, < 2017.12.7.2 | 2017.12.7.2 |
| ezsystems/ezpublish-legacy | composer | >= 2019, < 2019.03.4.2 | 2019.03.4.2 |