-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nystudio107/craft-seomatic | composer | < 3.4.11 | 3.4.11 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the order of operations in URL sanitization. The original implementation in safeCanonicalUrl() sanitized the URL before making it absolute via UrlHelper::absoluteUrlWithProtocol(), which could incorporate untrusted X-Forwarded-Host header values. By moving the sanitization step after the absolute URL generation in the patch, the developers confirmed that the vulnerability existed in how these two functions were ordered. The safeCanonicalUrl() method is the direct entry point for this attack vector as it handles canonical URL generation exposed to unauthenticated users.
Ongoing coverage of React2Shell