-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| feehi/cms | composer | <= 2.1.0-beta |
Miggo AIRoot Cause AnalysisThe vulnerability chain starts with AdminUser's beforeSave method initiating an avatar upload process. This calls Util::handleModelSingleFileUpload which lacks file type validation and directly uses Yii2's FileHelper::saveAs to persist files. The GitHub issue #51 explicitly identifies these components as problematic due to missing filename filtering and unrestricted file movement. The functions form a direct path from user input to dangerous file storage without security checks, matching CWE-434's pattern of unrestricted dangerous file uploads.
PHPPHPOngoing coverage of React2Shell