-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper URL sanitization in DynamicMeta.php's sanitizeUrl method. The pre-patch code only used html_entity_decode and strip_tags, but lacked urldecode. This allowed attackers to supply URL-encoded Twig payloads (e.g., %7B%7Bmalicious_code%7D%7D) that would survive sanitization and be parsed as valid templates. The critical fix in 3.2.49 added urldecode() before sanitization, confirming this as the vulnerable function. The CWE-74 classification and advisory details about URL sanitization flaws further support this conclusion.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nystudio107/craft-seomatic | composer | < 3.2.49 | 3.2.49 |
PHPPHPOngoing coverage of React2Shell