-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| feehi/cms | composer | < 2.0.8.1 | 2.0.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper file type validation during uploads. The patch added explicit checks for image extensions (png/jpg/jpeg/gif/webp) in User and Article models, indicating the Util::handleModelSingleFileUpload function previously lacked these restrictions. The beforeSave methods in User.php and Article.php directly invoked this Util function, making them entry points for unvalidated uploads. The CWE-434 alignment and commit message confirming extension restrictions further support this analysis.