-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a stored XSS tied to file upload validation. The patch modifies the get_allowed_files_extensions_for_upload function in Files.php, specifically removing 'pages' from allowed document extensions. This indicates that the function's prior behavior allowed file types (like .pages) that, when processed or displayed by the application, could execute malicious scripts. The function's role in defining permissible uploads directly relates to the attack vector, as improper allowed extensions could enable uploading content triggering XSS.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| microweber/microweber | composer | < 1.2.19 | 1.2.19 |
Ongoing coverage of React2Shell