-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability description and GitHub issue indicate improper file type validation in the storage feature. The attack pattern (modifying filenames via Burp Suite) suggests missing server-side validation after client-side restrictions. Pagekit's architecture would handle uploads through its Filesystem component and StorageController. These components would be responsible for file validation and storage operations, making them prime candidates for the vulnerability. The high confidence comes from the attack vector matching typical unrestricted upload vulnerabilities in PHP frameworks and the explicit mention of storage feature involvement.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pagekit/pagekit | composer | <= 1.0.18 |
Ongoing coverage of React2Shell