-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/framework | composer | >= 4.0.0, < 4.10.9 | 4.10.9 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient server-side HTML sanitization when processing user-submitted content via XHR. The advisory explicitly links the issue to missing 'sanitise_server_side' configuration and absence of cwp-core module, which would normally enforce sanitization. HTMLEditorField::saveInto and DBHTMLText::setValue are core mechanisms for handling HTML content storage in SilverStripe. Their failure to apply sanitization filters under the described configurations directly enables script tag persistence. These functions are logically implicated given SilverStripe's architecture and the XSS exploitation path described.
Ongoing coverage of React2Shell