-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control when regenerating image shortcodes. The commit 5f6a73b shows the fix added a configuration check (allow_session_grant) to the URL generation process. The original vulnerability allowed protected files to be published by manipulating shortcode IDs because the regenerate_shortcode function didn't validate if the user had permission to access/publish the referenced draft image. The test case added in the commit verifies that access grants are now properly respected during shortcode regeneration.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| silverstripe/assets | composer | >= 1.0.0, < 1.10.1 | 1.10.1 |
A Semantic Attack on Google Gemini - Read the Latest Research