-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.ktor:ktor | maven | < 2.1.0 | 2.1.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper encoding of Content-Disposition filenames. The pull request #3110 shows critical changes to filename encoding in ContentDisposition.kt's render() function and the percentEncode utility in Codecs.kt. The CWE-697 (Incorrect Comparison) directly maps to the flawed character allow-list implementation that failed to properly encode special characters, as evidenced by the added encoding logic and expanded allow-set in the patch. These functions were responsible for constructing vulnerable headers that enabled filename injection.