-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openmage/magento-lts | composer | < 19.4.22 | 19.4.22 |
| openmage/magento-lts | composer | >= 20.0.0, < 20.0.19 | 20.0.19 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient path validation in the deleteDirectory method. The patch adds critical security checks: 1) null byte detection (chr(0)) and 2) path traversal pattern matching (preg_match for ../ sequences). These missing validations in vulnerable versions allowed attackers to escape the customer media directory restriction. The CWE-22 (Path Traversal) mapping confirms this pattern, while CWE-77 (Command Injection) would be a secondary impact if file deletion enabled subsequent command execution through system file manipulation.