-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.whitesource:curekit | maven | >= 1.0.1, < 1.1.4 | 1.1.4 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly names isFileOutsideDir as the failing function. The commit diff shows this function was modified to replace a string-based startsWith check with a Path-based comparison, confirming the original implementation was insufficient. The added test case demonstrates a scenario where the old logic would fail (checking '/usr/foo/../foo-bar/bar' against '/usr/foo'). The string-based comparison in the original code couldn't distinguish between directory hierarchy and string prefixes, making it vulnerable to path traversal.
Ongoing coverage of React2Shell