-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from improper path sanitization when joining user-controlled paths. The commit diff shows the vulnerability was addressed by adding escapeDots() calls within joinPaths(), which strips '..' sequences. The tests added in FilesystemTest.php specifically validate() against '..' patterns, confirming joinPaths() was the entry point for unsanitized traversal attempts. This function's pre-patch behavior directly enabled the path traversal by trusting raw user input.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filegator/filegator | composer | < 7.8.0 | 7.8.0 |
KEV Misses 88% of Exploited CVEs- Get the report