-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| openmage/magento-lts | composer | < 19.4.22 | 19.4.22 |
| openmage/magento-lts | composer | >= 20.0.0, < 20.0.19 | 20.0.19 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient filename validation in file handling functions. The commit diff shows security checks were added to addImage() and write() to block null bytes and path traversal. These functions directly process user-controlled filenames during DataFlow uploads, making them the entry points for exploitation. The CWE-77 (Command Injection) and CWE-434 (Unrestricted File Upload) align with the lack of sanitization in these functions, confirming their role in the vulnerability.
PHPPHPOngoing coverage of React2Shell