-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient file type validation during uploads. The Wizlynx technical analysis explicitly references the isAFileWithExecutableContent function in functions.lib.php as the validation mechanism, showing its regex pattern (visible in their screenshot) didn't account for .pht/.phar extensions. This function's failure to properly identify these dangerous types allowed low-privilege users to upload executable files. The function's central role in file validation and direct mention in the PoC documentation gives high confidence in this assessment.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dolibarr/dolibarr | composer | < 11.0.5 | 11.0.5 |