-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| concrete5/concrete5 | composer | < 8.5.10 | 8.5.10 |
| concrete5/concrete5 | composer | >= 9.0.0, < 9.1.3 | 9.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from un-sanitized output in an image manipulation API endpoint as explicitly stated in security advisories. The patch notes mention adding output sanitization to this endpoint. While exact pre-patch code isn't available, Concrete CMS's architecture suggests controller methods like ImageEditor::view would handle image processing requests. Reflected XSS typically occurs when user input (e.g., URL parameters) is directly embedded in responses without escaping - a pattern that aligns with the described vulnerability in an image-related API endpoint.