-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net.mingsoft:ms-mcms | maven | <= 5.2.7 |
Miggo AIRoot Cause AnalysisThe vulnerability chain involves two critical functions: 1) The upload endpoint (/file/upload.do) accepts ZIP files containing malicious JSPX payloads without proper content validation. 2) The unZip endpoint (/ms/template/unZip.do) extracts these archives without file type restrictions or path safety checks, allowing attackers to deploy executable web shells. The reproduction steps explicitly show these endpoints being exploited sequentially, and the CWEs (434/74) directly map to unrestricted upload and injection flaws in these functions.
JavaJavaOngoing coverage of React2Shell