-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| feehi/cms | composer | < 2.0.8.1 | 2.0.8.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient server-side validation in file upload handlers. The patch added beforeValidate() methods with UploadedFile::getInstance to enforce file type checks, indicating the original beforeSave methods in Article.php and User.php lacked these validations. Both methods called Util::handleModelSingleFileUpload which appears to have accepted any file type when combined with client-side bypass (e.g., modifying uploads via Burp). The CWE-434 classification and attacker reports of direct PHP uploads confirm this pattern.
PHPPHPOngoing coverage of React2Shell