-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shiva | pip | <= 0.10.0 |
Miggo AIRoot Cause AnalysisThe vulnerability arises from the unsafe use of Flask's send_file function in shiva-server/shiva/fileserver.py (line 81). The application constructs the absolute_path using os.path.join with a user-controlled relative_path parameter. Since os.path.join ignores previous path components when encountering an absolute path, attackers can supply paths like '/../../etc/passwd' to traverse directories. The direct use of send_file with this untrusted absolute_path enables path traversal, as confirmed by the GitHub advisory and CVE description.
Ongoing coverage of React2Shell