-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unvalidated user input in the Asset creation form's 'remotePath' field. The patch added Symfony's Url constraint to this field, and the accompanying test case demonstrates blocking file:// protocol usage. The buildForm method in AssetType.php is directly responsible for defining this input field's validation rules, making it the clear vulnerable point before validation was implemented.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mautic/core | composer | >= 1.0.0-beta4, < 4.4.12 | 4.4.12 |
| mautic/core | composer | >= 5.0.0-alpha, < 5.0.4 | 5.0.4 |
Ongoing coverage of React2Shell