-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 4.0.0, < 4.4.6 | 4.4.6 |
| silverstripe/userforms | composer | >= 5.0.0, < 5.4.2 | 5.4.2 |
| silverstripe/assets | composer | >= 1.0.0, < 1.4.7 | 1.4.7 |
| silverstripe/assets | composer | >= 1.5.0, < 1.5.2 | 1.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of SilverStripe 3.x migrated folders in 4.x versions. The patch introduced FolderMigrationHelper to ensure Live stage records for folders, indicating that pre-patch versions lacked this migration. Functions responsible for resolving upload paths (e.g., Folder::getFilename) and UserForms folder validation (e.g., EditableFileField::getFormattedFolderName) would fail to enforce secure paths for unmigrated folders. The high confidence for Folder::getFilename is based on its direct role in path resolution, while UserForms functions are inferred from the linked patch in silverstripe-userforms.