-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| wwbn/avideo | composer | < 8.9 | 8.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation in objects/import.json.php. The code uses $_POST['fileURI'] to construct a file path and deletes it via unlink($source) if the user has upload privileges. Attackers could exploit this to delete configuration.php, which disables security checks. The patch added a regex check for '.mp4' to prevent arbitrary file paths. The procedural code in this file directly handles the insecure file deletion logic, making it the primary vulnerable component.
PHPPHPOngoing coverage of React2Shell