-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing length validation on the root directory field in administrative user management. The commit adds length validators to UserForm's user_root field (max=260) and related tests. The pre-patch version of UserForm in page_admin.py contained the vulnerable field definition without constraints. The process_formdata method would process unchecked user input for this field. The tests added in test_page_admin.py (test_add_with_user_root_too_long) specifically validate this fix, confirming the attack vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rdiffweb | pip | >= 0, < 2.4.8 | 2.4.8 |