-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.metersphere:metersphere | maven | < 2.5.1 | 2.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from FileUtils.createFile() accepting arbitrary file paths without sanitization. The function: 1) Deletes existing files at the given path 2) Creates parent directories recursively 3) Writes file bytes to the path. Without validation of the filePath parameter, attackers can use sequences like '../../' to write files outside intended directories. The patch in v2.5.1 adds filename validation, confirming this was the vulnerable entry point. The code structure and vulnerability description directly implicate this function as the vulnerable component.
Ongoing coverage of React2Shell