-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| topthink/framework | composer | <= 6.0.12 |
Miggo AIRoot Cause AnalysisThe CVE explicitly references AbstractCache.php as the vulnerable component. While the GitHub issue demonstrates an entry point via a custom controller, the root vulnerability lies in the Flysystem cache adapter's deserialization of untrusted cache data. The load() method in AbstractCache is responsible for reading and unserializing cache contents. When combined with ThinkPHP's object instantiation patterns (shown in the exploit chain using think\Model, think\route\Url, and League\Flysystem\File), this creates a pathway for arbitrary code execution. The high confidence stems from the CVE's direct attribution to this component and the inherent risk of unserialize() operations on external data.