-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xpressengine/xpressengine | composer | < 3.0.15 | 3.0.15 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient file extension validation during uploads. The GitHub issue #1366 explicitly mentions adding .phar extension filtering, indicating the file upload handler previously lacked proper extension checks. The FileHandler::handleUpload (or similar) would be responsible for processing uploads and validating file types. Without proper extension filtering in this function, attackers could upload malicious files. The high confidence comes from the direct correlation between the patch's purpose (adding extension filtering) and the typical file upload handler implementation patterns in PHP frameworks.
Ongoing coverage of React2Shell