-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| codiad/codiad | composer | >= 1.7.8, <= 2.8.4 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability explicitly references components/market/class.market.php as the entry point. The Market class's remote file retrieval functionality would be responsible for plugin installation from external sources. Since the advisory specifies SSRF through plugin installation, a function handling remote resource fetching (like getRemoteFile) would be the logical point where user-controlled URLs are accessed without proper validation. The high confidence comes from the direct correlation between the documented attack vector (plugin install feature) and typical SSRF patterns in package management components.
Ongoing coverage of React2Shell