-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper sanitization of SVG uploads. The key evidence is in the ImageUploader.php diff showing the addition of SVG sanitization using enshrined/svg-sanitize. The original vulnerable implementation (prior to patch) directly wrote file contents without sanitization. The commit adds a new sanitizeContent() method that specifically handles SVG sanitization, indicating this was the missing security check. The CWE-79 classification and advisory details about SVG-based XSS corroborate that the image upload processing was the vulnerable path.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sylius/sylius | composer | < 1.9.10 | 1.9.10 |
| sylius/sylius | composer | >= 1.10.0, < 1.10.11 | 1.10.11 |
| sylius/sylius | composer |
| >= 1.11.0, < 1.11.2 |
| 1.11.2 |
KEV Misses 88% of Exploited CVEs- Get the report