-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient file type validation in the ResourceUploader. The patch added a content_type_allowlist to restrict uploads, and the commit message explicitly states this was to prevent HTML uploads. The vulnerable version lacked this allowlist, relying only on check_image_content_type! which was insufficient as it only handled image validation. The tests added in resources_controller_spec.rb confirm the attack vector involved HTML file uploads through this uploader.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| publify_core | rubygems | >= 8.0, < 9.2.5 | 9.2.5 |
Ongoing coverage of React2Shell