-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| camaleon_cms | rubygems | >= 2.1.2.0, < 2.6.0.1 | 2.6.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability manifests in the media upload URL handling logic. The 'actions' method in media_controller.rb directly passed user-controlled URLs to cama_tmp_upload without localhost validation. The patch added a local_url? check and error handling precisely in this method, confirming this was the vulnerable flow. The function's responsibility for processing external URL parameters and initiating fetches makes it the SSRF entry point.